Extracted

• • Target

    70459c4985da2c11b2baa8b746c86e4cd031470d1c216b2c13b87763c4485647.vbs

  • Size

    72KB

  • MD5

    f2a4031c9fcc69f1bc32eb62b35651bb

  • SHA1

    b97f66f3c831d887c8e1e3e4ca209784262b5c23

  • SHA256

    70459c4985da2c11b2baa8b746c86e4cd031470d1c216b2c13b87763c4485647

  • SHA512

    7e50b481b4268f474e5ab387c00221d0b29eea79cfbb7a025ddd6cf01aea397c626478b0af94d4ec6d0631fe65f9b331581511060d61c23474066fd665f6b0e6

  • SSDEEP

    1536:bdW0MXa09sT3o202+TpydNFMLSEGgcX4XTA66Mrhrpj:bds9DfTpUcfj9pj

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  behavioral1behavioral2