Extracted

• • Target
    Payment_Advice_0977_08_04_26.pdf.vbs
  • Size 2.5MB
  • SHA256 2941d37b59ab71e459e58326d76b2f3855081aae576d2f7d01102f83a2616553
  • MD5 255a58b1be0525342a57926268b86be3
  • SHA1 a0c34cfae3babb0a24677d28f1222a33c799c349
  • SHA512 e7c76a56e716b88cae3c63d62c9f4e237c25cbff7e743dcf9569de930aa41f795221484ad807be8de735bd5939016a01a7431d4e3392f96f3a5276de531f14f7
  • SSDEEP 192:fG6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6C:52
  • TLSH
    T135C52141A51148E8714CB1F0E850B5B5B11DA8096616F9CAD7A37CFB6E838FEC6B0C9F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • System Binary Proxy Execution: Regsvcs/Regasm

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2