Extracted

• • Target
    Sipariş - 05.04.2026.vbs
  • Size 2.4MB
  • SHA256 5f45b1ee165a750cae48dea599b7ed585fe28b44f4a7e215e62486efa6480513
  • MD5 ee002fb541b6e60d3568e1e482c31364
  • SHA1 837a659b96badf23d5005224ae68ddcba6d01195
  • SHA512 c57e77ff14986e3c5a47192ffef212c181e38317d7483dc8ab5de24392bdc712ba49670f6e2016357300ec001638fda4c9f8e1fc32d051e9eae0e0d7cd70c767
  • SSDEEP 768:giiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiio:Mir
  • TLSH
    T1B6C520794D99D76D3EFD0D0BF26567882718B90B6BC664F745ED2DDD2E2ECA8008008E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2