Extracted

Extracted

• • Target
    SA261481YS206 OZB SİPARİŞ.vbs
  • Size 1.8MB
  • SHA256 829666c9ca09e25643beeb9aa5fa973a478165dcc0473cbf5483a81efc74a203
  • MD5 160efc0b8c2643014fa3d0e8e25f8a24
  • SHA1 b92b179c1d1d68a6d59883e6b6927393af8447a6
  • SHA512 9b774ccaba2e263b9fcf62c43db0070b3430f04cfea65e46acc2f4745636b8150585cf8b2ef0f12bd8b6105f0fb4b1ff27c76bfe415f79af095df3d83e45d212
  • SSDEEP 96:Xh987AY0kMV5RrI09vyEGvL0mS1dnvLHeF5zSSe6E3TqreF3zexo6ExdzdnvNE3M:R98l0py+KqM4fGQ+DlJAIDM
  • TLSH
    T1969512CFA65DD6019EC2E18A6AEF3D179F3286AD3D410EB6520E9EDB344810FC1A31D5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2