Extracted

Extracted

• • Target

    Offertopurchase.js

  • Size

    47.0MB

  • MD5

    e633eaeb161017eec584bd3f042cde07

  • SHA1

    6c0181476a703f2cc7232d62213dbcca8d6d2cf3

  • SHA256

    375d690a75254f5b58018e443205c6800270e553234845d92378b90023c9dc13

  • SHA512

    605fd043c9978d8f8834bef3a65f07e3513e53c5b2dd15f4a3853fba87e93ae05df4987921e40c9e29c1d8850f3ce090ffce48714601c55bf85eb00c7de5234d

  • SSDEEP

    3072:g0SaHey6uGxBKa+OKaGWvPa6Oua6W21lq6+Oq6GWPv6aOu6aW2J5Ka+OKaGWvPak:j

  Score

  10^/10

  executionstormkittyxwormcredential_accessdiscoverypersistenceratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2