Extracted

Extracted

• • Target

    7e716d3e3294621ecbfca2fb2344659adab0186027eb9cf4511617db9bf8896d.vbs

  • Size

    681KB

  • MD5

    746d8713599ad10435ccced5549288b5

  • SHA1

    457928dea2de0daa5742f05d51ab8b18aefb893a

  • SHA256

    7e716d3e3294621ecbfca2fb2344659adab0186027eb9cf4511617db9bf8896d

  • SHA512

    dc1f3da919b6b8e9044f489ccb0fdf95f18ddd70cbf7dd12a4a01adac0876d5b2a2ddbbdafa6384ead6f769b9e71827bf9dc67fcd8fae146e28234b89fff42b4

  • SSDEEP

    1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222v:UChJDK

  Score

  10^/10

  executionxwormdefense_evasiondiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2