Extracted

• • Target

    XClient.exe

  • Size

    145KB

  • MD5

    9ed864b6eaabf32d1fa70cc6b0c0c39c

  • SHA1

    7c657049d6b5dd79d1937fb33abfd8f6d58e4a9a

  • SHA256

    0e24f1d56bc9acda5afb857fdb2c96ee295fd9b34efab29e95eae849367bd5de

  • SHA512

    759201eaf5f4da105badbbce6a5db8c32e2c8a05a7a09ab45fdae38bc8573b1a51f5cb3633260ceb8e33cba6917bc38b13c910d76398988a532976ef2b2eba34

  • SSDEEP

    1536:kztwdf7oj8bdGdU3RTbfGhaKDcWS6JRQOVdIeBdFfw/joT3/4o:S2s2dGdixbfFKZRQOVWe1fw7oLX

  Score

  10^/10

  stormkittyxwormdiscoveryexecutionpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1