Extracted

• • Target

    tre.bat

  • Size

    186KB

  • MD5

    49a0a6fd50d78530a1d0165530bbf452

  • SHA1

    d7c0a6fda37c34e19da741946624e33632372f01

  • SHA256

    9eb51151389425c487c68c0f293d80fe0c8f894aedcf797fbc37e8bdf4cf1ecf

  • SHA512

    1e64aa6cc815dbc537164dec8ef885bdee00e6a02836065c0dadbb440737eb9a1ec361aa6cd9c3c6d8e545a817c554b76b132fd81d4c24089208e8b5c7be1dc1

  • SSDEEP

    3072:Y3QUaDntxn+cceixWDdNllmYtUA8HnUe/EEQjnj/2+AZ8E9zl7LWe9hCWANSblHO:IQt+wixAjSYjcEE6j/2+A+2zl7aemM1O

  Score

  10^/10

  executionstormkittyxwormcredential_accessdiscoveryratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2