Extracted

• • Target
    Invoice #2776 -4554-6756-3452-4354.vbs
  • Size 2.2MB
  • SHA256 db611037dbaa20af42c02a5fb505e4f4ced6b52c00167a2dc0e73ca526b3aad9
  • MD5 8856d0bfe2cd0d09d022d128f6e81094
  • SHA1 a07dc8cfe52add4daafc5c21e5f1535a5e4223a1
  • SHA512 4764dac6ed4226f088bc21941702d76e9b87ecdc263ff926d966d380ded54a643021a1b07da22f017fc720ddc784e97100b87b471a8541f313e2170f47135cdf
  • SSDEEP 768:Y1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1RE1R1:QN5
  • TLSH
    T19AB53433C19E1BE5227D19E1C84DB67B27D5D7180282A958EB947E805FE1CE383D90AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2