Behavioral task
behavioral1
Sample
XWorm V5.6.zip
Resource
win10v2004-20240508-en
windows10-2004-x64
| resource | yara_rule |
|---|---|
| sample | family_agenttesla |
| static1/unpack001/XWorm V5.6/Guna.UI2.dll | family_agenttesla |
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
| resource | yara_rule |
|---|---|
| sample | disable_win_def |
| static1/unpack001/XWorm V5.6/Plugins/Options.dll | disable_win_def |
| resource | yara_rule |
|---|---|
| static1/unpack001/XWorm V5.6/RES/XWorm.Resources.resources | family_xworm |
| resource | yara_rule |
|---|---|
| sample | family_stormkitty |
| static1/unpack001/XWorm V5.6/Plugins/Recovery.dll | family_stormkitty |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/XWorm V5.6/FastColoredTextBox.dll |
| unpack001/XWorm V5.6/GMap.NET.Core.dll |
| unpack001/XWorm V5.6/GMap.NET.WindowsForms.dll |
| unpack001/XWorm V5.6/IconExtractor.dll |
| unpack001/XWorm V5.6/Plugins/ActiveWindows.dll |
| unpack001/XWorm V5.6/Plugins/Chat.dll |
| unpack001/XWorm V5.6/Plugins/Chromium.dll |
| unpack001/XWorm V5.6/Plugins/Clipboard.dll |
| unpack001/XWorm V5.6/Plugins/Cmstp-Bypass.dll |
| unpack001/XWorm V5.6/Plugins/FileManager.dll |
| unpack001/XWorm V5.6/Plugins/FilesSearcher.dll |
| unpack001/XWorm V5.6/Plugins/HBrowser.dll |
| unpack001/XWorm V5.6/Plugins/HRDP.dll |
| unpack001/XWorm V5.6/Plugins/HVNC.dll |
| unpack001/XWorm V5.6/Plugins/HVNCMemory.dll |
| unpack001/XWorm V5.6/Plugins/HiddenApps.dll |
| unpack001/XWorm V5.6/Plugins/Informations.dll |
| unpack001/XWorm V5.6/Plugins/Keylogger.dll |
| unpack001/XWorm V5.6/Plugins/Maps.dll |
| unpack001/XWorm V5.6/Plugins/MessageBox.dll |
| unpack001/XWorm V5.6/Plugins/Microphone.dll |
| unpack001/XWorm V5.6/Plugins/Ngrok-Installer.dll |
| unpack001/XWorm V5.6/Plugins/Options.dll |
| unpack001/XWorm V5.6/Plugins/Pastime.dll |
| unpack001/XWorm V5.6/Plugins/Performance.dll |
| unpack001/XWorm V5.6/Plugins/ProcessManager.dll |
| unpack001/XWorm V5.6/Plugins/Programs.dll |
| unpack001/XWorm V5.6/Plugins/Ransomware.dll |
| unpack001/XWorm V5.6/Plugins/Recovery.dll |
| unpack001/XWorm V5.6/Plugins/Regedit.dll |
| unpack001/XWorm V5.6/Plugins/RemoteDesktop.dll |
| unpack001/XWorm V5.6/Plugins/ReverseProxy.dll |
| unpack001/XWorm V5.6/Plugins/RunPE.dll |
| unpack001/XWorm V5.6/Plugins/ServiceManager.dll |
| unpack001/XWorm V5.6/Plugins/Shell.dll |
| unpack001/XWorm V5.6/Plugins/StartupManager.dll |
| unpack001/XWorm V5.6/Plugins/Stealer.dll |
| unpack001/XWorm V5.6/Plugins/TCPConnections.dll |
| unpack001/XWorm V5.6/Plugins/UACBypass.dll |
| unpack001/XWorm V5.6/Plugins/VB.NET Compiler.dll |
| unpack001/XWorm V5.6/Plugins/VoiceChat.dll |
| unpack001/XWorm V5.6/Plugins/WSound.dll |
| unpack001/XWorm V5.6/Plugins/WebCam.dll |
| unpack001/XWorm V5.6/SimpleObfuscator.dll |
| unpack001/XWorm V5.6/Xworm V5.6.exe |
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Feb 21, 2023
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Mar 8, 2023
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detect Xworm Payload
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
AgentTesla payload
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.