Extracted

• • Target

    7977dcda33f70efcfde7817d3a54fb1ad6a41b97842c709a699c10747df4ede8.vbs

  • Size

    155KB

  • MD5

    b280a8bc4f8a6540a76abf5a10195e51

  • SHA1

    833903eb2385c0703ba081eb24c3b6654859452b

  • SHA256

    7977dcda33f70efcfde7817d3a54fb1ad6a41b97842c709a699c10747df4ede8

  • SHA512

    6bbf9ada7d0af0c366a96b8b626dbb9479c02e24c3005403bfe890c8ac268cd9bef2b641ff266745521779907757acfaa44dcd106ace2ebe3ae0bfe9b6d104ec

  • SSDEEP

    1536:IbruDZJuZJd99CObitCocEW1aJK66n5yhtW0/5JpWnQcoVd9owng0B3bUZlu9gIo:sruDZJuZJdI9JK6X/fcoVd99ng0B3cn

  Score

  10^/10

  executionpersistencexwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2