Extracted

• • Target

    6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7.bat

  • Size

    379KB

  • MD5

    03c6c2175f84ad54c989f0608d3cbb57

  • SHA1

    9846d7aa4c639d038f428977dfe0eef7db8ac009

  • SHA256

    6d04562cf9d1e0ee7b7c77af40e1e3299b6eba9375f35978d9776d94a9dae3d7

  • SHA512

    45bc9713a632904216f5bfd3e5648542382bc5c3aa8fa5253eea9f04d6592ac0aabcffc02451261210835f4f4d57c1f4895b7d02be24dd5edffbdc5e5b5e13c8

  • SSDEEP

    6144:xdlplCiywRsuBfq3Y3zzyMECoefagF68zh3IHstkjcGH9z2eRTbYXa8KZITbq:xrCiHWuBS3Y3zzyDCoefPQsy/qeF6KZl

  Score

  10^/10

  executionstormkittyxwormratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing credit card regular expressions

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2