Extracted

• • Target

    FUD.vbs

  • Size

    325KB

  • MD5

    d525be35ac5b7de70edb7c00529f1d83

  • SHA1

    eef5cd4c355487132d225492acdc425fb0fe606d

  • SHA256

    f9f35704de5a2355e9b8b7107613736b5501573cfb9794126867ccd73100ea98

  • SHA512

    32e399504a0669e0c83872a947cf24955489f2b3f75dae83cec2798681f4249d6bac02f861436fcbf6b8d2321045ab7fbc6c006bf33ca1402429ce799e254830

  • SSDEEP

    6144:PAbSQwEhvxxx06qUY2fVHavDdl8PI76KF51u7WJVzZF:PAbBlhqp2fZsDdlYI77BVlF

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2