What is Klingpremium.xyz? Malware Analysis and Mitigation Guide

Background

The sample is a ~314 KB Windows batch file (SHA-256 26ce0c34…fdda4) that automated triage rated MALICIOUS at 90/100. Public sandbox analysis identifies it as stealercuaxmoinhat.bat and scores it 10/10, confirming it is genuinely malicious. It is a multi-stage loader: obfuscated batch that pulls and runs a later stage rather than carrying the final payload itself, with klingpremium.xyz acting as the delivery/C2 host on the abuse-prone .xyz TLD.

Two things in the automated write-up need correcting before publication. First, it flagged ‘ransomware-related behaviors’ including possible encryption or shadow-copy tampering; the observed behaviour is a loader / likely info-stealer delivery chain (download, persist, geofence), so the ransomware label is a generic heuristic, not a confirmed classification. Second, and more instructive: the engine’s machine-learning ensemble scored the file 0.0% malware probability while the behavioural engine and external sandboxing rate it 10/10 malicious. That is a classic ML false negative on an obfuscated batch script, and a reminder that ML-only or reputation-only scoring misses script-based loaders.

What we observed

What the sample actually does:

• Geofencing first: the script checks the computer’s configured country code in the registry (System Location Discovery) to decide whether to proceed, a common way to scope infection to target regions and dodge sandboxes.
• PowerShell download cradle: it invokes PowerShell to fetch a next-stage payload, downloading an MZ/PE file from https://klingpremium[.]xyz/mrx.zip, so the real malware arrives at runtime and is not present in the batch file itself.
• Registry Run-key persistence: it writes an autostart Run key that relaunches a staged batch file at C:\Users\Public\Downloads\xmetavip2\9a.bat, surviving reboots from a world-writable public path.
• Obfuscated, multi-stage design: the batch is heavily obfuscated and staged, which is exactly why the analysis engine’s ML model returned 0% while behaviour and sandboxing flagged it 10/10.
• Likely payload: the filename (stealercuaxmoinhat.bat, roughly ‘newest stealer’) and the download-and-persist behaviour point to an information-stealer as the delivered stage, though the specific stealer family from mrx.zip is not confirmed here.

klingpremium.xyz loader chain

The batch file carries no final payload. It geofences, then PowerShell pulls the real malware at runtime, so behavioural detection beats file signatures here.

Attribution

This is opportunistic, financially motivated commodity crimeware, not a named nation-state actor, and no confident malware-family match was established (consistent with a builder-based or repackaged loader). Confidence that the sample is a malicious loader is high (10/10 sandbox score plus corroborating behaviour); the specific stealer payload and operator are unconfirmed. The ATT&CK mapping below is analyst-derived from the observed behaviour, because the engine left most techniques unmapped.

Confidence: 85%.

A 90/100 verdict on a script the ML model rated 0% malicious. Obfuscated batch loaders are exactly what signature-and-ML-only tools miss.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Indicators of compromise

Defenders can block or hunt the following:

Detection

Copy-ready hunting query:

# Hunt for the klingpremium.xyz batch loader chain (behaviour-first)
# 1) .bat / cmd spawning a PowerShell download cradle
index=edr parent_process IN ("cmd.exe","*.bat") process_name="powershell.exe" (command_line="*Invoke-WebRequest*" OR command_line="*DownloadFile*" OR command_line="*DownloadString*" OR command_line="*curl*" OR command_line="*bitsadmin*")
# 2) C2 / payload indicators
index=dns OR index=proxy (domain="klingpremium.xyz" OR url="*klingpremium.xyz/mrx.zip*")
# 3) Run-key persistence pointing at a public/world-writable path
index=edr registry_path="*\\CurrentVersion\\Run*" (registry_value="*\\Users\\Public\\Downloads\\*" OR registry_value="*xmetavip2*" OR registry_value="*9a.bat*")
# 4) Staged artefacts and geofencing
index=edr (file_path="*\\Users\\Public\\Downloads\\xmetavip2\\*") OR (registry_path="*\\Control\\Nls\\*" AND process_name IN ("cmd.exe","powershell.exe"))
# 5) Known hashes
index=edr (sha256="26ce0c348b76396e687edc81002072ac22bb855289b619ad81b44c54db4fdda4" OR md5="c0784eb93af833cc99d39d54fefc53cc")
#
# Correction to remember: the ML ensemble scored this 0% malicious. Do not trust ML/reputation
# alone on obfuscated .bat loaders -- pivot on behaviour.

Recommendations

• Block and monitor klingpremium.xyz, the mrx.zip URL and the file hashes at the proxy, DNS and EDR, and treat newly-registered .xyz hosts as elevated-risk at egress.
• Hunt the technique, not just the file: alert on batch/cmd scripts spawning PowerShell download cradles, and on Run keys that point at C:\Users\Public\Downloads (or any world-writable path), both fire regardless of the loader’s obfuscation.
• Correct the triage before acting: this is a loader / likely info-stealer, not ransomware, and the 0% ML score is a false negative, rely on behavioural and sandbox evidence, and re-tune any ML/reputation-only gate that let a 10/10 sample through.
• Assume a stealer landed: if the loader ran and reached the internet, treat the host as compromised, isolate it, reset browser and application credentials, and rotate tokens, then retrieve and analyse the mrx.zip payload for family-specific IOCs.
• Reduce the surface: restrict PowerShell (application control / constrained language mode), block script execution from public download paths, and enable script-block + module logging so the deobfuscated cradle is captured.