Extracted

Extracted

• • Target
    Comprobante de pago.vbs
  • Size 942KB
  • SHA256 cadf283eb0ce75f0907bac1c60dbdc89ead2e98eb8ec929353c24f420cfc1a17
  • MD5 07f892bc1092ef382131416551b6ab5c
  • SHA1 eedc1af2facc239a235005b0dae69233e7097dc6
  • SHA512 a64faff9641c575addae420f797911776b7a25710179a596457f9a6ed715d21eeebe4e80f72315524350921b0188b4c088f349d39f8e9eb82f4076f491abcd0a
  • SSDEEP 768:e2RVNhVpULxI0um/kPGm6QistRC+CAeFTJkDZWwfbtaEz5ESLNH98Gdgfs4CnU+x:Hr
  • TLSH
    T124258962C6CD4BB065F09E3DAB3A1D8B97E1792C90816E0F4F5D11F56D28FEA4E43089
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2