Extracted

• • Target

    4c8bd4a1bdada3e9ff3a8cdb69948484733842c099f7bac5fc22c1aff00edf00.exe

  • Size

    1.6MB

  • MD5

    7e2087055a8ab78c0025757274549257

  • SHA1

    efa42811180edcf632a8a51a3a20093f67b65745

  • SHA256

    4c8bd4a1bdada3e9ff3a8cdb69948484733842c099f7bac5fc22c1aff00edf00

  • SHA512

    fd0da6cb646cc1fa24e29118f5d8d1ebb1da35cf4205a05dc39a3c5c250958641c85f4031d6e59df1a751030a0f5a946677f4d4b288a0b6da5767f4629b5e08b

  • SSDEEP

    49152:7bdYAm4zrbdYAm4zobdYAm4zvbdYAm4zdbdYAm4zZbdYAm4zqgfa:ndr3drCdrzdrddrRdrqgi

  Score

  10^/10

  stormkittyxwormdiscoveryratspywarestealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2