Extracted

• • Target
    WhatsApp IMG 07-05-26 Payment advice.vbs
  • Size 2.7MB
  • SHA256 51cf4209be2c160f3182f2488e68eec40edd7e9f9f76224fa4b66d4ec74a35bd
  • MD5 49cb9069b85abb848febad5884d61a5f
  • SHA1 fdd260f303aba9acd08772b397fa05d4820413b8
  • SHA512 c39fee62bf4b91e4ebf87c26a8eb2029176055832fddfe60aad3d0c5d318e2ac76d000559c10d11ea29185764f186751ebf6b1300308d641bf9ea76847f40038
  • SSDEEP 768:7uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuT:H
  • TLSH
    T149D5AF315E84BAB0D3DB01E3F514D99DE5EE671B290DEEC9C1EA4D0523808F89CDD4AA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2