Extracted

• • Target

    Uni.bat

  • Size

    359KB

  • MD5

    358406bc7ed5155f85a5ff1c578ee295

  • SHA1

    4e333529ae320ad77ebcc36fd9baa55796dc001d

  • SHA256

    da95cdaddcd020f216d54f93ebb9f0c8246b9dc1d02d9df60d898bc6c58e8ecf

  • SHA512

    0017064f87d9b5458e17c7e7348aa1ad0a3b1713ae44c202ab71e271b6a8a76bed7a3142cebe0b4a10c08220fbfae4f109a784151ca85130d48dbcb4dee65f45

  • SSDEEP

    6144:ZbaZI71pQSxrJ9chRObtodtQlcxWHovdigPbYDDV:Zbac1ySxr/3bU3FzUh

  Score

  10^/10

  stormkittyxwormcredential_accessdiscoveryevasionexecutionpersistenceransomwareratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2