Extracted

• • Target

    XWorm V5.6 BypChat.zip

  • Size

    24.5MB

  • MD5

    5116c90421cd33a0f65ddb7db5b375a8

  • SHA1

    cc64c23d3499d281ff4157196cb6cf767ce81b16

  • SHA256

    20d451a0dfdbe692e40dd450812ebb94e7b04430acc0de77cecfa4daf1a99e95

  • SHA512

    b9ed3129540e815d24df87a81af4bcd32a27e8585d43059abd073a39ef4349df538ec5b2d61b5705ea167084eb45a16d8edac5fe584eaf40e6a67d3eb7965e11

  • SSDEEP

    393216:LyavqkXFeuBc9Q+FMIZeL859fCGcJ7kj3HHAKbTmbubKXo50Ko+Y2ToxYC:LyxkXDBYQwNZK5kjQKRIo5Ho+0

  Score

  10^/10

  stormkittyxwormevasionratstealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • UAC bypass

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Disables RegEdit via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  behavioral1behavioral2