Extracted

• • Target

    XClient21.exe

  • Size

    65KB

  • MD5

    1f0562410589065ddf2069df97270eb0

  • SHA1

    8c96e3b03034a206e5fe6146cbfc08c425215a04

  • SHA256

    0bc6914fa7a3303d3a3a3682c17402b1fa5a55f95b9f05b8e01b5cd7b589435f

  • SHA512

    98e3cc133e91a0fb8c7d169abfc53d461fdb654d656cda7ff259fa88f918288f80f0ea4b2e185b861f211ec6b7246a82d3dccb52ba623ebc7ba0565339c5c59d

  • SSDEEP

    1536:hdS7RGHg/yHtTyn/xb1h+bkCtFZ62yInODbOxI9Pm:fSWgKqxb1h+bkGyInODbOxIlm

  Score

  10^/10

  stormkittyxwormdiscoveryexecutionpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1