Overview

overview

10

Static

static

3

fc91e5e4c3...99.exe

windows7-x64

3

fc91e5e4c3...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc91e5e4c357d97b7fcba5d6fa69b869528056d2654e58a6d00a61e5cf942899

  • Size

    269KB

  • Sample

    240417-bmgesshe97

  • MD5

    d6a4ae255aa4fec929e0c5a13eedb39d

  • SHA1

    547f76b98b6117a7f61c551dfd75835b8d2a0379

  • SHA256

    fc91e5e4c357d97b7fcba5d6fa69b869528056d2654e58a6d00a61e5cf942899

  • SHA512

    f7764c179abf0d66bce5b3d337cacc8ed26db3801b23ed3463de727d0869e8248ae72a770157a431f13970754daca138d1b4ded3c6103ee74b74bc7b28f89490

  • SSDEEP

    6144:315S7307BuAqGslctMrQpOHjniFXLtkisUkD8:315JSGSctMrQpOHjILd

Score
10/10
stormkittyxwormratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

quh6kDzTMLtsV6q2

Attributes
  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/zgmeGAte

aes.plain

Targets

    • Target

      fc91e5e4c357d97b7fcba5d6fa69b869528056d2654e58a6d00a61e5cf942899

    • Size

      269KB

    • MD5

      d6a4ae255aa4fec929e0c5a13eedb39d

    • SHA1

      547f76b98b6117a7f61c551dfd75835b8d2a0379

    • SHA256

      fc91e5e4c357d97b7fcba5d6fa69b869528056d2654e58a6d00a61e5cf942899

    • SHA512

      f7764c179abf0d66bce5b3d337cacc8ed26db3801b23ed3463de727d0869e8248ae72a770157a431f13970754daca138d1b4ded3c6103ee74b74bc7b28f89490

    • SSDEEP

      6144:315S7307BuAqGslctMrQpOHjniFXLtkisUkD8:315JSGSctMrQpOHjILd

    Score
    10/10
    stormkittyxwormratspywarestealertrojan

    • Detect Xworm Payload

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks