Extracted

• • Target
    SHN2026000000026.vbs
  • Size 1.5MB
  • SHA256 fe4a930a99df7e32db43fd5545ff08a1ff89bce1343bf0ef2af3fcb1b7006907
  • MD5 5873a091904bba25ec8af467d9d8edfe
  • SHA1 b7af939b494e66fbbd8eca01ab25fd105b650254
  • SHA512 b1a37fb43d29f92bcd24cff6e83f547fb68694db6b7d9507921863b04af6f551be649f5d26433ea769bee231f1ad4ffa8abe42ed4bca31d048748b15970e82e7
  • SSDEEP 768:OcCGCviADeVGmLHS9WUYiH+alKMoBp4YoXzc6tXzBfheaBMBl:Ob48WUBjDBNq7
  • TLSH
    T1EF75C59816DACA0BE40310C53EA7697F9CF582B1025F4D42435FF27286AFB0E979719E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2