Extracted

• • Target

    rat source (1).bat

  • Size

    8KB

  • MD5

    71625b19d0e541d47bc8ebaecbafd90b

  • SHA1

    adff53d3670dff92cb81958499419ef34d3a272f

  • SHA256

    378e258b6da98b9f20497500d4e40fb19cf63bc2946f00f4139a3f46b745c82a

  • SHA512

    fb949b9c6cab9e3fd2eab101bf071c3c19fcd60e5b079848b1edb626d97a87cca5806d639f2d6521f2be3e0a94f692693c482682aad13b639fa51a2a98335bf0

  • SSDEEP

    192:2RngaveQ7/HcgdMVtTviDizHclFgGcUOHjeeeU4Yheeen3gWDeeeVDjeeeU2GhfE:2RngaveQ7/HcgdMVtTvGizHclFgGcUO0

  Score

  10^/10

  xwormcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationratspywarestealertrojanupx

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery
  behavioral1