Extracted

• • Target
    Shipping Detailst.vbs
  • Size 2.4MB
  • SHA256 03d9b9675a98583ec96b59fec63059641e320cbc8774de2dfa736ab06cd008b1
  • MD5 2dd19c1ab7885a0c89206917adc6f03d
  • SHA1 ae571089bd1a730338d072115fd05353d3d91ed6
  • SHA512 af95949060971a2692ecb012da1bd1106f20eb6a41ea961ef5f3e04d00276913f32579e70f9f5b0d863acdd530357239639b8cf985dbb147013e91da452e9718
  • SSDEEP 768:eoP5YTdCk1sFm/jlD7jBB6+/CNcgc16+CSqqB/+KcqCpi7JvvqvWVdvvaN2JIl3Y:y9
  • TLSH
    T1B0C57D606F3B8975DE24FEAB617046E01BC9830A1497CB805CC6DE5B4EE5BB099BDC1C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistencerattrojanupxdefense_evasionprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2