Extracted

• • Target
    myxwr5cli.bat
  • Size 379KB
  • SHA256 6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7
  • MD5 03c6c2175f84ad54c989f0608d3cbb57
  • SHA1 9846d7aa4c639d038f428977dfe0eef7db8ac009
  • SHA512 45bc9713a632904216f5bfd3e5648542382bc5c3aa8fa5253eea9f04d6592ac0aabcffc02451261210835f4f4d57c1f4895b7d02be24dd5edffbdc5e5b5e13c8
  • SSDEEP 6144:xdlplCiywRsuBfq3Y3zzyMECoefagF68zh3IHstkjcGH9z2eRTbYXa8KZITbq:xrCiHWuBS3Y3zzyDCoefPQsy/qeF6KZl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionstormkittyxwormratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2