Extracted

Extracted

• • Target

    ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d

  • Size

    352KB

  • MD5

    c465ada59596b24ce7ec12859f022d1f

  • SHA1

    ce4d09b3a355ed0f5f88bcdc1fcdac749862b728

  • SHA256

    ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d

  • SHA512

    b9563c08c2c76334d78e73b59e5a9450469e002030b28520231708e756185742bc96f115e887753a51512616e81e9a7f4a44d3314647c088c58bbe0f644b675f

  • SSDEEP

    1536:jh2F+VOLE9uko/3o1v4c4g2EePv/qcwUNQX3vGcXaA+7/BzGdZQn2sk82SCGZjjI:jeV1CZpyM

  Score

  10^/10

  stormkittyxwormratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2