Extracted

• • Target
    message_10194_part_0.eml
  • Size 20KB
  • SHA256 dc6297cde0aca82d8502d8f3ad8d833be2d4958d47118e061aef0cb42c6fbeae
  • MD5 2ad8cb34698a047c7bbb7bd509ddd4b9
  • SHA1 20a28bf44b4558c45c6392823f317e8a16991c24
  • SHA512 efcd2b218ce3a41b3f8201a6f3100ccc19b53017f9c902a4c29f8cc73d2418c0c6b67050ee584901beb5ef3b1f6f1b028d9e4f4c0da06e10775a88f97b9e0b3f
  • SSDEEP 384:I6XFFLQpkIONOhIFOnO6OPO2OOFOqOIIlNl4lhXIgaO+dFobzvvE3OaUP0m6D6Ko:I6XnLikuHlNl4ldaOeibzvtP0mQ6eUQC
  • TLSH
    T17C926C7EEB062453E5BF05E9B11663CAAEB04ECBB31158B05173A79D6CCDC20259B391
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionxwormratspywaretrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2