Extracted

• • Target
    Ödeme - Swift(MX)_pdf.vbs
  • Size 1.2MB
  • SHA256 429e410fac87f603340c5007dc6b6be5f59876cc2437bd28fbdd17cf0f4206a6
  • MD5 b7c5ec3a0b238f61c0c08a9b5c3c4e11
  • SHA1 5a4780352595c8ac96075d45d368b1683e46c72d
  • SHA512 22a161f7ad1d6962e0f1a11b2e62db99493ae426fb04680f2f6af20527aaf4e00bda2bbfe7367a254cd75e1664e6c88ee16a86bd39b2780a58e4f757cd233ca8
  • SSDEEP 192:tMX8cF5ywhabvMObXJTskXryQ0tkfpe42j+wXj:tQ8QywhabvMObXJTskXryQ0tkhYrj
  • TLSH
    T1D24592346800F139B76AE91130ECCD244CA8173E7AA1E071D9F5ABB776EFA4D6D82531
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojanadwarepersistencespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2