Extracted

• • Target
    Solicitud de nuevo pedido.vbs
  • Size 184KB
  • SHA256 654c289d639c01e2ce1fcb1e26e8f0449406a2ccba8dad95074e1b4ce6299303
  • MD5 94e9b11457764b33ba60c7da12489aea
  • SHA1 c438511d5a20e67c840512f114b104f675cc733a
  • SHA512 2ae846257e95177e60e1d819e00a81e43b0450b37ea1ba3a59e76cb6ab993e47bb69cc8abe2181b0e87ce7e9c5655d21479a7b0b64f350afd974666f512a04b9
  • SSDEEP 3072:B0CymWEjrlQAejFA5bO8neBw3O0S8zlsT8FRuTAMvilgJ2Zqi3ijjY2mij3ACz8/:BjhOpjFAbO8nem3ZS8zlEORuTAMvilgY
  • TLSH
    T1F704F163FE991501A43CA20AF9569C12CD104BF28F5536243E8D95BC1BF02377FAD6D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpyinstallerratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2