Extracted

Extracted

Extracted

• • Target
    Juily New Order 0707.vbs
  • Size 1.3MB
  • SHA256 4d44df689cecff38963a303af1fd779a19f15cbe021c290ed67184b29271bc1f
  • MD5 df8e666d80d489ea8a968e1b282dcfeb
  • SHA1 83b9a0e3764aafb99aa1d448f1ad1b7c3ff717a3
  • SHA512 cff1c284ea725163bf61b87768f8dd5b16bf8fc7bbd053415c95e98d6992bd0b42853957a62566c5583203a241925e70df061ee4bf01317bf659f072cf48c8d3
  • SSDEEP 192:mW59o2OFXo4Q6QrQQWQUFkQpQtQfQDQlQ9Q2QflQYQPYtuQQ+nQ5nIQKKYlszxef:m+hwB
  • TLSH
    T15055A210ED1F1B52F4FF32B974B2ADA269992044C6116D9746F84E225133EEF31ABC6C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslaxwormkeyloggerratspywarestealertrojan

  • Detect Xworm Payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2