Extracted

• • Target

    LibraryDownload.exe

  • Size

    171KB

  • MD5

    0f4733702f7441130c76f92271e33d52

  • SHA1

    962c64538ad4b11b0a57a269e726476eaf1e5cd4

  • SHA256

    b96640cb2a36f9bbaf48fe4798091068b9f518af783236e759763f2386f6a157

  • SHA512

    3718e10cdbb2dd1089a3cc4437c0884593ed0194953e0e0d6865b33475ffd2d8b9bcdffe5e8fade78eb4078b6777ca65618617a2563007b77998c273d85be0f5

  • SSDEEP

    3072:vOMQnN3iDf+bpT7E3ubGoOmaG8vwps/Bz65/M6If+3Js+3JFkKeTnu:vOnxwWboub+As/xBt25

  Score

  10^/10

  stormkittyxwormdiscoveryexecutionpersistenceratspywarestealertrojanvmprotect

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence
  behavioral1