Extracted

Extracted

• • Target
    375d690a75254f5b58018e443205c6800270e553234845d92378b90023c9dc13.js
  • Size 47.0MB
  • SHA256 375d690a75254f5b58018e443205c6800270e553234845d92378b90023c9dc13
  • MD5 e633eaeb161017eec584bd3f042cde07
  • SHA1 6c0181476a703f2cc7232d62213dbcca8d6d2cf3
  • SHA512 605fd043c9978d8f8834bef3a65f07e3513e53c5b2dd15f4a3853fba87e93ae05df4987921e40c9e29c1d8850f3ce090ffce48714601c55bf85eb00c7de5234d
  • SSDEEP 3072:g0SaHey6uGxBKa+OKaGWvPa6Oua6W21lq6+Oq6GWPv6aOu6aW2J5Ka+OKaGWvPak:j
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionstormkittyxwormcredential_accessdiscoverypersistenceratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2