Extracted

• • Target
    ORDER_RFQ Signed.vbs
  • Size 2.6MB
  • SHA256 a46d328e7bcee448006caf44fc6bf4603e6c9948f717074a3350316121d1a9db
  • MD5 7f6354da87f475641906bb9bf8a99706
  • SHA1 f680b330f0d865f1beb33d17275f2c8a2361143e
  • SHA512 5e3a156c8c32da2c57599a03a2541db7a2d6d74bed90f85c070a9b62bd291411acfbeab5f5d1cf7931bab78223f66462dc468ce009e003e22544ffc1f520de51
  • SSDEEP 192:FddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddA:w1021db
  • TLSH
    T1BBC532DC46255327DB82369BDEBAC8384954EC13BF262FA2AD7615B3F5C076412FA04C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2