Extracted

• • Target
    Contract.vbs
  • Size 174KB
  • SHA256 cb2a7ca834acfa88aaf921b91fc0831369c8f9ea4979cb3f8f0f9b0449c09f70
  • MD5 9739ebece3eafa90b3a954afd2009dca
  • SHA1 b5b28e80140535e8010dadd03603ce458f410e2c
  • SHA512 7368976342019a3281d59cec979670d6cfc690c3fba71175d3c3551f61b8052cce2349f30b17f94e5dc3fbb3868765f8b843123c86540f767bb57bc573c65b82
  • SSDEEP 3072:USIGlElZ1kfndVxYZa0WtT3lANQfUObj6BpAdOOfmABF4u69Xc/mz:JIE/x5023i6fUObjw5OuAANc/0
  • TLSH
    T1440412228D481ABD82F668F148F29F9FB9367F716120C1F2BE9E9049CB1E11754D897C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2