Extracted

• • Target
    cotizacin.vbs
  • Size 2.1MB
  • SHA256 c07ddbc7f72a1750c58cc99f793cd555b3da121f9e15f653a5cede4dad0006c4
  • MD5 5666aa56d66a9eb090b26650ee07f63d
  • SHA1 a56bc4365cd87f8273ed2e3f487faddbedc8a1fb
  • SHA512 676e689daa206cf15b47e52a6fe5ceb0afa924d7f5d6b092e658ffb67114c67da8513d9be0271c5f0ff87120374931534ac4d9a8e43226f73c16badd15b4dfd4
  • SSDEEP 384:x6Bvpc57ebfSbRF5A3exXn5RaUxRkNso4:uSo4
  • TLSH
    T132A514626948A2EAD68F40513DC858C13D4F2B38F5DFBCA6CC414DD0B942A95BFD34BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2