Extracted

• • Target

    Project Al Ain (Hilli & Al Fou’ah) Parks.vbe

  • Size

    274KB

  • MD5

    ffe9b9de145969a32320dbbfa6dd5fe6

  • SHA1

    845f94bea47738145737b413992ef141af93e69c

  • SHA256

    6513f2777a217402f9fa6196dacc31c948dfdde0680ccba57879b1c8d2cd11f8

  • SHA512

    be162b21b798c681ab7146210d5f2cb742bd9a49aff6778ea9614decf6688f511b172ee8e632c19cc01092b3f9233655b08829652cf8c93bd07e1b2d9ac28e88

  • SSDEEP

    6144:/2AuQvH6zYFyqnL+ct+7og/6zyGfcbygrvjAw6LVWPLaFUy:/Mc+7OzUbyobTWeu

  Score

  10^/10

  stormkittyxwormratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2