Extracted

• • Target
    Copia de confirmacion de pago.vbs
  • Size 887KB
  • SHA256 98ae3f60a6f753207f4880cf211c155677c2b1725e0911d0eca3ccea97a199bd
  • MD5 9734e9cd44c3e99341c97b49bcf86189
  • SHA1 3097624ee15a8034cb961155286207ec22e9299b
  • SHA512 a006c711ee6ab9b0699f0cdd81240d1410b89c4e7bf657400de17ed3662a60b810b90da204eba0e58c5774b746f3e891046d7fce918afa05a882681bf20ec2d3
  • SSDEEP 768:S63BkWSDawU4SpWDaBMFpZVa2IQMd/jrCzONxvNa2BcwvdNpRJgPqy6w75AWcYH5:zAf0NRO
  • TLSH
    T1471595874109EDE1C213FC75F681A6C6AE9601079E6BACE37D171AD8A032F7248DDE19
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2