Extracted

• • Target

    sample1.exe

  • Size

    45KB

  • MD5

    d4e300eb8ed5bc378b50c2c0fa73dd82

  • SHA1

    de0f866207fa8d5018a82aa75261a65b7d6697bd

  • SHA256

    80e3e1b6447f2f22593ca40b29a153060c2c92bb5e237d2932a275f87dc16146

  • SHA512

    ffaeba3bd79aed5b1f812dcb07efdddf27ec38c788a042f78c57d3caabb363a8c6720df2d0cf9b830b8c73dea2d8350e5e700408c4e831ce3287793aed9b5a8f

  • SSDEEP

    768:+Dl1L0/tSsg+vpZzXOC/5G6hKCJmt02XtRkbyh2M3qQYHzYOahWlte:wzL01rrzXOCRthKCJa0wkby0LYOawHe

  Score

  10^/10

  stormkittyxwormdiscoveryratspywarestealertrojanpyinstaller

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2