Extracted

• • Target

    Outstanding_Payment.vbs_.vbs

  • Size

    10KB

  • MD5

    7d736f2af918d503db2e0b8139d155ae

  • SHA1

    b41d9474dfa719a9971a571eabc148c174e2bd24

  • SHA256

    3c66afe6ed426888388935d671be049f948a30a58b866b4cf669c7eea88e059f

  • SHA512

    06ceeefa45b62026b3e61f49aed4a29e3ff4b2d832d1050740b173b07147edfcb4d2bb6e611072dc4b2435e1b18d441092009a806cb1cd52f5e9fca48b6b240e

  • SSDEEP

    192:GbC4tuunETpXgAdZF7+txQTof3aeBjhY/Hg12p3mXBP8xX:YMOspQY+txBryWV8Z

  Score

  10^/10

  xenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2