Extracted

• • Target
    message_9811_part_0.eml
  • Size 48KB
  • SHA256 9085c9ed562ee4401ea4b1a96fb6c80a99e8880cab3a833906448f4414773101
  • MD5 041ae69508da8beba48db5cd896815c2
  • SHA1 4d1b952abd9432ab0e50513563153d0766f430b9
  • SHA512 df501da2ba3f434cff3e25742c10075e7b072387200e2e6aaa4874f3054890d1111528d43873aeadb7d1295869f66f63f94984d0d6c8c7743afcf57c5d53da33
  • SSDEEP 1536:V9WT+fb3sufOyRf4pAMGW9Xp/g7Rn00A1y4l:TWIbbfOys/MVu1r
  • TLSH
    T1D423E109EBDD62970063ACFDB02EB64DF2B01D457BC0E498359A8D90198E72E3347396
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionxwormratspywaretrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Sipari=?UTF-8?B?xZ8gLSAgIDA1LjA0LjIwMjYuN3o=?=
  • Size 31KB
  • SHA256 bc4353cae5df38df81a951571f81f97d1edad589e0b556cb9aa3fbf3b4069d3f
  • MD5 5be1f0f5c91f46eaeaa7bbaed26e30f8
  • SHA1 0e29cf5f6e70d7349bcd1aeeda05b1dfabb2cea3
  • SHA512 5bd07e2e1a059ac1b77836a3ea420aa85d5e3e755055abc120d1813181648c136f83874e47a0834ac256072e39650b64c5faebe759014b77dcbdd81219c6695b
  • SSDEEP 768:99XMGGIEUaJ1Jh4F1jpLVN9arhZQDKj3EdtST:rMGwnh4FPJWrQDKGtc
  • TLSH
    T16BE2E17C9D2834B58C6457AA04A19551FA7E25D8C2FE32287BEFF62D8320DB8CF1C515
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Sipariş - 05.04.2026.vbs
  • Size 2.4MB
  • SHA256 5f45b1ee165a750cae48dea599b7ed585fe28b44f4a7e215e62486efa6480513
  • MD5 ee002fb541b6e60d3568e1e482c31364
  • SHA1 837a659b96badf23d5005224ae68ddcba6d01195
  • SHA512 c57e77ff14986e3c5a47192ffef212c181e38317d7483dc8ab5de24392bdc712ba49670f6e2016357300ec001638fda4c9f8e1fc32d051e9eae0e0d7cd70c767
  • SSDEEP 768:giiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiio:Mir
  • TLSH
    T1B6C520794D99D76D3EFD0D0BF26567882718B90B6BC664F745ED2DDD2E2ECA8008008E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    email-html-2.txt
  • Size 2KB
  • SHA256 11149a435d1d8eba09d30a9fefcb2b455072416807c46bc87e927189240cbd71
  • MD5 decbdeea67fcee340d6a430715576436
  • SHA1 7f07ec43df48d6d3cb22ecb614203c1dff827df5
  • SHA512 9f4174395ba2e3be982cf2dbbd0c38a33542b6c1f4436d9c0347d18be05b534eb9ef1ce61987a4d2350d530da1985d9b55ae097d8596548112c7f7b918839bbf
  • TLSH
    T10E51F107D3920E4583320CF471BB6B4435350B8EAB064C241B6AA7F6E9CE47533923D9
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral7behavioral8
• • Target
    email-plain-1.txt
  • Size 10B
  • SHA256 ba1ab65ae584c99dc72e3c004aaeeeda1cb32d88c5c9160c200ce6d2e520f45f
  • MD5 f93fadb4a1fc7a47d3a77657cf8fc13f
  • SHA1 87db91eba47f171613f3e9beb6a12472b9123734
  • SHA512 c9f5aa72a5171791e8f8f0c31326e6fecef26fb469528f4cdea95dd8a3bcfd9d7db896645913028293568f0fae4eee75b43e55bf0abc76fddb65dfc50584fd2c
  • MD5 SHA1 SHA512

  Score

  3^/10
  behavioral10behavioral9