Extracted

• • Target
    T0053 FA 168447-168448.vbs
  • Size 1015KB
  • SHA256 b5e4c44dab086a0170006e9de46df82b5b8d78765fb32a59f720cd01b4ae8cae
  • MD5 2519f9e1e54bb82c3ebe3cd127fa36db
  • SHA1 56764dbde2ee30cfe90e7f95a1f51f406b33b7d2
  • SHA512 dbd497a54199eb56199c10228d6c164500f93224aca855ac55f483df9ae41396e7acfd2b1a1069cd9f8d0ea6cc575efd93fa303ebdc7a1817e7f21d108ef2c81
  • SSDEEP 96:rAZ8jDP8ElFI8zivmHqN+hdDEd1Xr7Us2WfpeG0mcU:PDdryXfUhgp/0mcU
  • TLSH
    T1BE2541CE9E7B10585F108A1FE6E5E8904F9060652D3AC7F9E1F4946183FEE8F3158A93
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2