Extracted

• • Target
    source.txt.lnk
  • Size 2KB
  • SHA256 47d4598feab8c5f558273ce041a121a5850d0e693b2d622297873429bd8a4966
  • MD5 c25a3d6ba7042d0acc4086271861d298
  • SHA1 f574c6774b107be790beabd515bca73661f7ede3
  • SHA512 4549dbb109b9a65430d272c624e22b3f86286bf46b9b93ed19f915860a9f025cb4f52cbee8459de6ef6f026e848cce5b47aaedf7fc94af9b9d26276abebe895f
  • TLSH
    T154415A1467DA1710F3B78E3768BAE2008A357C59FD729F9D4190858D1829911ECB6F2B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionransomwarexwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2