Extracted

• • Target
    vvv.vbs
  • Size 1KB
  • SHA256 05ce9e030ca6e12da3c8dbe80b6b65131448b694980223b548cba07f0bba4292
  • MD5 28963018c4addb12d84d7fdfa95f8143
  • SHA1 4ba9bb58dbecf5f2afd0dc70d6eaa55bd0ac1ae2
  • SHA512 fd5340b045f6d2097afbde447e2a9ef88f319d0cefcfa0b5f3321470b4126cc4054ed5a5b9f4e69e607864537ed449bf721ff0e207d7f6373820d82b57e14c9f
  • MD5 SHA1 SHA512

  Score

  10^/10

  executionxwormrattrojandiscoverystormkittyspywarestealer

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2