Extracted

• • Target

    XWorm V5.6.zip

  • Size

    24.5MB

  • MD5

    27065dd8016564f65a5444d70a9daad1

  • SHA1

    1be1151330b7b0f12c486e9e36a1fa682adcac50

  • SHA256

    7c62a831647b0234a097ff94b160e0534d7c465d7bbd6fca8953c951a55157cf

  • SHA512

    fcf41ba034133fcb7f91936fb16a6b59503a9016a78079c61fd692edec24a7e3daadf8ae2459d36ecd6c72dff9f8835355ea8cc7d20455d3e0922d74f7337435

  • SSDEEP

    393216:VyavqxXFeuBc9Q+Fdt6ieJS9xCZGb7kjjJ6AKbKrbdcjXo50Ko+Y2ToxYv:Vy5xXDBYQwn63qkjBKego5Ho+R

  Score

  10^/10

  stormkittyxwormdiscoveryevasionpersistenceprivilege_escalationratstealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • UAC bypass

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  behavioral1behavioral2