Extracted

• • Target

    df.exe

  • Size

    58KB

  • MD5

    b194de4adb59afb5c4392f8a56fe25c0

  • SHA1

    1f482bea8edc37c763901923d11adeda24946057

  • SHA256

    e1273e480ea564ccc1d037c9f47ee5a378aec0d196f434a3d99b687f547a83a9

  • SHA512

    687674f8f300c9352f8a35030307f433672749163cf43caece8bb7b46d3af9c22f9a93ff93b0c0e6fd74bbe4277527e9ffae10e581cf0b2551078d05521d49f8

  • SSDEEP

    768:Hv8jto5Hcw3xwKFYwqNxghTaFjMYnGLppEzJL5Ykbo8fBuzfAUkBvmL8QnhUcAVJ:HgFyT/nENMHLTUJmkbNfYTAB3POvDE

  Score

  10^/10

  xwormrattrojanstormkittydiscoveryspywarestealer

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2