Overview

overview

10

Static

static

3

OC 13065.exe

windows7-x64

10

OC 13065.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03072024164603072024OC13065.rar

  • Size

    394KB

  • Sample

    240703-wh6t4s1cjn

  • MD5

    f661eb832779dd6625c1e7e0487e30ec

  • SHA1

    48ca1c277bbfd5cf24af4093d3143b6a02b60e3b

  • SHA256

    d4edd94a065d71ae37cb48c64a09e3dab0996096f8a98a378185b26816655e42

  • SHA512

    54c8ad522c8df79c7dfe616734049969dbc27aedac6ea76a1c4e5e9d57159b8fed1860b0bc44491ac09e05f4e9db2d5046b8cfaab5011d7ec1cd1690b1478ba5

  • SSDEEP

    12288:cHpjXQcEn18KJSowylLKPd39G2eP591uMdogqgmUyrX:aInCAU0Gl4H59EMdoqmP

Score
10/10
stormkittyxwormratstealertrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

185.29.11.111:7000

Mutex

B3bYPcOfuxE4gqjQ

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      OC 13065.exe

    • Size

      1.8MB

    • MD5

      26a81e6b9da7801ca3bd29c4b4d6b76c

    • SHA1

      50e5cb8380bbc9f11f3b5bcd477c86f3b4ac6263

    • SHA256

      f8850f3a39201ecea1e5bc30c07dad691e1b8db1a1eaeada7ed3d859e69a630e

    • SHA512

      1a671f454bc48e108a831e9e1a2231a56cfcc0ee5c73c6f523d9764c75d256e32c070492a5d562250d64439422cd5658503afa00f69fc75e317e4193103854a8

    • SSDEEP

      6144:Rx1iwfMPTymGeIHp58TY4adHganYLP3GAr0fSTSZlzOtvw9rI6HDCFixI+JAn3wk:b1Xd6T6qWArcSGZlgvw9rImCF+I93wk

    Score
    10/10
    stormkittyxwormratstealertrojan

    • Detect Xworm Payload

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks