Extracted

• • Target
    Pedido de Compra [POF0000095].vbs
  • Size 1.3MB
  • SHA256 391edbfdd1f3011d914612342f927b20b6268d4e9effbd7e7b90f5428d827c16
  • MD5 d9da897141471576d80cb358e96729d6
  • SHA1 d3ea311a7661027b3a77f7b8d7e313ae82f42628
  • SHA512 9688796241d2239779b58f5360eb61ecb57b17b986b90e3a12ff9585231defca6028f9e573a0ffdcdc593d4f96e2c818e9361b7d127fbbd1fd5a0728a5316fe0
  • SSDEEP 96:bAu7dt7TJjXA1dqg10AqVqjPw5qnNGGlq5jPw1qH1ATAe5qnk7TJjXA1dqDPqS1Q:JuiOKuqihKDUq
  • TLSH
    T18655A4F0E23152177A2C166DF8DDE895509BBF264A78088B9FDDC51651CE8E8B8B0F4C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2