Extracted

• • Target

    69b9a6e877091453c7666503152f0041be593624eff2c4d9f183963faa2db01b

  • Size

    445KB

  • MD5

    0dc1afcab234d559ed8ba999d744b977

  • SHA1

    7bd9f0e8d7f6fec77c6dc716e14cd4db1912ae79

  • SHA256

    69b9a6e877091453c7666503152f0041be593624eff2c4d9f183963faa2db01b

  • SHA512

    9b052b5fa31c31f421ba799c35df763b4c03a424cf58419d57e4aa01e89b384b367bfb91840cfdec1f749d5c3bc6ab52d020ca63ec92639ac05c18d3308ae645

  • SSDEEP

    12288:Hj3HI695n5a4Fgl2qwD3yfrE1IrEtXXqnX9dfbFGBv2F:HbHIw5k2qIyfDQtXXqnXnbwB

  Score

  10^/10

  stormkittyxwormdiscoveryexecutionratstealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2