Extracted

• • Target

    XWorm V5.6.zip

  • Size

    24.5MB

  • MD5

    547e575e76fe43feed2f97b0a6b68b3e

  • SHA1

    631dcbd8db53d6275b6236d766a72ad31f5079d4

  • SHA256

    24ea380b035e8768f116f4e20aa1bede85c070c5511b439a020a700ac94b7723

  • SHA512

    630f72520ff9dae8d7cbe4237d1cc6964397867fedf3ca154b9c5bff443bcbad3d574a38ac06af3bf4e280fc9538e0c0bbe54ab90fb333d208193f35342b6ec5

  • SSDEEP

    393216:VyavqxXFeuBc9Q+Fdt6ieJS9xCZGb7kjjJ6AKbKrbdcjXo50Ko+Y2ToxYP:Vy5xXDBYQwn63qkjBKego5Ho+x

  Score

  10^/10

  stormkittyxwormdiscoveryratstealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  behavioral1