Extracted

• • Target
    TPURIN01260601401.vbs
  • Size 1.5MB
  • SHA256 879dd84317070383446e37d5fd07a1c4d30b493a4a4bf9a6d15de20e77ddec30
  • MD5 77ad828b4844f85888b44513c295ae93
  • SHA1 da9a7cfa02cf1ce771befa185ff150d068f86fc2
  • SHA512 e18ba8471a0c81467dec2f17cc33ab149240de05b79a638506c2c83ce9cc54e45eb583e1f49ce25e37bec62cb4d00dc8e7648bda687dc44805046bcb9c215f20
  • SSDEEP 96:UHEWWaAltFmQYx444Wy9EnK1nzciMya3znaCUFKwgiRpj9zAdPgRmoks5wDcArNB:kEWW79B5xTQJu9b9525NttNvK1i/QfXS
  • TLSH
    T1C6759A55A02BB669F7C76BE62DE72F1C08ACD81F600840AB3A50175ABC3494F31DDB9D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2