Extracted

Extracted

• • Target

    awb_post_dhl_delivery_documents_pdf.vbs

  • Size

    177KB

  • MD5

    63fa1b58e48acb386a8b650951530771

  • SHA1

    adf30b16e042e3d4cf2c5c570ec0afcf446afac0

  • SHA256

    119a6e21aa53c235fe4a946d74e870b41823d1cf49c39d29a528e1a0ddfd9042

  • SHA512

    8c328b2876d05cb649190578565daa152f145e0dce86b3aae8eca826f09796040fcc856911050e2540a9df92cf923c90cac6848e5326e2040dd415993dcd7107

  • SSDEEP

    384:JffffffffQffffffffQffffffffmh44444444D4c0YAL8ZNGJoNycffffffffQfS:K0Yq/G

  Score

  10^/10

  executionxwormdefense_evasiondiscoverypersistencerattrojan

  • Detect Xworm Payload

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2