Extracted

Extracted

• • Target

    @Cybnux_XWorm_v5.6_Cracker.rar

  • Size

    19.7MB

  • MD5

    0b87bf0a97079e39453d580707339f8d

  • SHA1

    e6cc2b04766f9942c90caba2046bfbd936210d2b

  • SHA256

    17ff9f594f93a70b84c110c94e0341d2385260642e4f036cf2fda381c66be4ba

  • SHA512

    514c4ee3c37e4f1d92e8ba980c1d64cfd8b2bcb4b5daecffa527bd43850a9bac737e362244bda78970b3d044bca51ebc9ad95bfc868a9808dd44c965913ca2bb

  • SSDEEP

    393216:rya9e39neJPF6z48TCtSTNzFpatK/GGQLmHbOoe47Q3pOHT3DEu8tlI:ry33USlWANzv85y7Jeh3kbsC

  Score

  10^/10

  stormkittyxwormdiscoverydropperratspywarestealertrojanvmprotect

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Download via BitsAdmin

    dropper

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1