Extracted

• • Target
    confirmation_of_funds_transfers_docx.vbs
  • Size 32KB
  • SHA256 636b3d4415bcef243aa3197eb8ca3ab4a1546deb981c0946ef196487f4cf4500
  • MD5 293ae8644cb957e783d7bba21c18d7a2
  • SHA1 2b2b566cc80ab6d6ed6c53cea9771c17dc1655f6
  • SHA512 73187deafcbc76895c4a54f119178b9358a68818d23b344b938f0b07013414ad0e963199121f1434883d9a825eb5bc5ce3a0a8b49f41baca124ae7cfb9b34690
  • SSDEEP 48:RAcL3pdbDMsgItfWRxhH80zPy7f4dfP4ZUFO48idtIQ6MsQ7OgMtPeSSRIcbE11C:RAcLZdb4JOu80z4f4t4ZUc48SttR0i
  • TLSH
    T1C5E241D8E04560E29931F7E31849C2D3DB23BEE7176E8F971D1D2A0923730B6AD26D42
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2