Extracted

• • Target

    2024-09-30_2cf5cddefdb9208bea01442cad44896d_avoslocker_hijackloader

  • Size

    3.6MB

  • MD5

    2cf5cddefdb9208bea01442cad44896d

  • SHA1

    1b2f02ed71659f7fa21d8ac3ca9d18ee90b13097

  • SHA256

    9bca28e8dbaecaadc97b1806a97c0d6410b3a10b682e7cb8331693e06c77d8a1

  • SHA512

    e063b1ee8852260a741d56222acb5f0b7318d78d9bb9b0a54abedce97af7ae3c5492fc4136861f1c8c1b4dace87b1b694e15bcd9e4f0f27e5d6ef0a9a997840b

  • SSDEEP

    98304:ze3/NQcGeqxQat113OU/jIEeQfoR/IuOFVjUu5:zGmreqxV13FIF0wu

  Score

  10^/10

  stormkittyxwormdiscoverypersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2