Extracted

• • Target
    XWorm.exe
  • Size 13.5MB
  • SHA256 5bfca9c997f452d4f001abcdfdd1115aa0ef97d5ba2cc48b4523f6fb87a0ba7a
  • MD5 1e7daac9ab67c09a7ca1ebceae3326b2
  • SHA1 7312fc660bf03b863de0d4346e3ef462724626e6
  • SHA512 5dd037b2f5e0e71c1190c3d300f257ae3fb5f2f9eac142d03e702058f960c9017f1511767a38403f00aae8ee73d6d5ac91095e8389e6fbc254ea2dbf82d7be90
  • SSDEEP 196608:KOI24UT0mBlShweFDkiVl9qDgC4lukrWuPqllxlshCsWHmn:KOI2pi7dkiVqUJ5rWdtlsMsWHmn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stormkittyxwormcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1