Extracted

Extracted

• • Target
    Payment _Ad.TXT.pdf.PNG
  • Size 935KB
  • SHA256 ae07a74fad35fc9c50d6b649c9e8ba5cdf90034b09a9a22481096e6bdbc0be8e
  • MD5 875b940e05fa9c2ba05a3e7da4218161
  • SHA1 c0082eba7431988deff66f5394fc0bfe9ec45e8b
  • SHA512 5212e4af9173f8765ed9c9ef6f8cd07575a0d43e1b5be6d052b00fbdc3b3ba887a0669ea0786474b5fd3fd43c3f612a1c6e04ae4744334a1dbef6b7987ac7830
  • SSDEEP 768:9Vn4on5Ly49DRCVewkWh0yaV4GcmYItNDe4476+LmIBK6HoxHhPiY5JhUv4lVYoi:B2z
  • TLSH
    T14F15BAEDD0C6F2B18391582423BB2680C861E0998AEC5FF56379072653AFDDCB79F095
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2