stormkitty

General

Target

XClient.exe
Size

159KB
Sample

240725-p196xszanl
MD5

11f839617cf012397407fbe61b098887
SHA1

465debfbb666272611191d928c3ef21b9f4ca176
SHA256

97348373111ca04f11967c85f6af5c81bad013d0f48588509ad8e0a69a9efecb
SHA512

b1f3d3b0b93e8c02c30551ebf70f067fe522c0afca96a585fb984897c641bdb4614b3392d63b6f6b072ba9181a06f99b3707447c1e3ef661483940f82841e91f
SSDEEP

3072:GwmAm5efb7bMOQHURwBz65/M6If+3Js+3JFkKeTno:ftfbvHwxBt25

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

low-ivory.gl.at.ply.gg:34642

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Targets

- Target
  
  XClient.exe
- Size
  
  159KB
- MD5
  
  11f839617cf012397407fbe61b098887
- SHA1
  
  465debfbb666272611191d928c3ef21b9f4ca176
- SHA256
  
  97348373111ca04f11967c85f6af5c81bad013d0f48588509ad8e0a69a9efecb
- SHA512
  
  b1f3d3b0b93e8c02c30551ebf70f067fe522c0afca96a585fb984897c641bdb4614b3392d63b6f6b072ba9181a06f99b3707447c1e3ef661483940f82841e91f
- SSDEEP
  
  3072:GwmAm5efb7bMOQHURwBz65/M6If+3Js+3JFkKeTno:ftfbvHwxBt25
Score

10^/10

xworm execution persistence rat trojan stormkitty credential_access discovery ransomware spyware stealer
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2