Extracted

• • Target

    rDoc5633276235623657_xls.exe

  • Size

    84KB

  • MD5

    d5489da5aa14ed9d71d8338ec41a1bc1

  • SHA1

    fe04a678f7d95ed31bd364e0a8a4831964f2b84f

  • SHA256

    96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1

  • SHA512

    68ae7b3c2367f9a2124dba4549ee90dede2fd12552acb7823eae42ffa014e7f4b37cb95b836d01de1270cbc3a48d2903988dc69d1f4f7646d39a9d0b7c77a940

  • SSDEEP

    1536:WGOLl+jxSwe51ZMXEw1PfEeRH0bndlu630VDx:WGOBCtE1ZpwJbSndTEVDx

  Score

  10^/10

  stormkittyxwormdiscoveryratspywarestealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2