Extracted

• • Target

    fcadb0f8b3f4d2f62ee32686bc4c9d93493145ae9720a28d0b2afffdf253e66d

  • Size

    71KB

  • MD5

    9175e0d4944a8add7461d6b0f312e321

  • SHA1

    92f40d5e927a96eff9c6916a651bb7e17dd0b31a

  • SHA256

    fcadb0f8b3f4d2f62ee32686bc4c9d93493145ae9720a28d0b2afffdf253e66d

  • SHA512

    4f5716a1353289dc58f2256832cd360fc138f031e5b7d791b4317576108efdf4a7f331382951862505ce4731604a54a32488feef360090db0f7fcac2135a1eb5

  • SSDEEP

    1536:6ZbC2aJTIHzeerbZurGcywF3OKSW0QW0Qe:6ZOTIFbZu6i3OW0QWk

  Score

  10^/10

  stormkittyxwormcredential_accessdiscoveryratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2