Extracted

• • Target

    file.exe

  • Size

    16KB

  • MD5

    54ec587044fdff4bfd0029946041a109

  • SHA1

    242cc5fdd5c75a02776f1f5e526cc42cf138b313

  • SHA256

    e666b2644c35f564041ad18c5125f1677255f05421ad18785aed42bfb3ac5adf

  • SHA512

    6e2c9f3b3850c021b0db78af02f37e6fe1b32bd046ba5767b0499f2c4af11586e167c80235258b5536bcfece567a18f2e2eca6a107e60d5efb62a65175049046

  • SSDEEP

    384:vQ/pw4zDzEe2PGVMN0kc/aw9BsjGpATcQC:vj4EebD+a26

  Score

  10^/10

  discoverystormkittyxwormratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2