Extracted

• • Target

    Shipping_Documents.pdf_.vbs

  • Size

    72KB

  • MD5

    d8e3bf5f66fd94bc6eac4c31a80752c7

  • SHA1

    19b8f112fe35de01170434a90c9080155dfa0736

  • SHA256

    db330e50d5573d582f7874ae62c48052bbf899c89ee27b3a0639a526b0e3232f

  • SHA512

    647ae0f8e7eef2aceec6dc27d8ef0fb64c63712ad02f4fa0b81329b844276ecc0bd2d429960f8c1b4928c806cf1c82b59dd8826a4a558ed2726da645640985d1

  • SSDEEP

    1536:rNx0vFMLSEGgcX4XTA66MrhifWezrLm3kaHV/wSCDCfcP8p:rNx0yfj8fWey3Hcuyo

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  behavioral1behavioral2