Extracted

• • Target

    mine.hta

  • Size

    48KB

  • MD5

    8ec81411709c0d3ca73859814204cd71

  • SHA1

    7da6542e29c888d65a857cf5876ed8e9e6524510

  • SHA256

    6840b6d84f7c7190424fd465e466e2477e7c8a781457e2c6dcd523df498cea3d

  • SHA512

    ece006bb69841cf02d64c95c0534376934fa073b89eab8f85cc3323f647f1a326198d56cad9666d5b6152e763e2859e945e8794a877c75808f224b27201eec14

  • SSDEEP

    768:SOLDbrv8XXl7qCk0BU6zoWvXqfM0JYJ4Tpdsfq0H5wj/:SObstqCdoWvXqfM0JY40Kj

  Score

  10^/10

  executionstormkittyxwormratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2