Extracted

• • Target
    Siparii-75158991-803.vbs
  • Size 1.3MB
  • SHA256 1c3f44b252b785f6fd6792c424bb2844e9349421c480939c9181383931666535
  • MD5 3d0853af1d7753cb7f5329f4aca92724
  • SHA1 f1e8a619ae51aa2817aab0f0db93e3a60ff74998
  • SHA512 1cf6f2f9b651ade225f987ac90b6cecc80519d91a663bf481e4ef3925fd89156bbe23c0938b91f0e29d3d708bbf4cccdb45a57ebcdef0542e701fb35231688f5
  • SSDEEP 384:WCWM6nMj1SeM9C4ARKsujVMwBt7APMSZMgDrO2SKjq:wMIM7Mw9qM+OM6Mg6
  • TLSH
    T18A5582950A3E042A9DFF53CD3EC5941235395CA1EC20EFEEF6B859254A0AF1A7E7090D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojanadwaredefense_evasionpersistencepyinstallerransomwarespywarestealerupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2