Overview

overview

10

Static

static

10

XWorm V5.6...at.zip

windows7-x64

7

XWorm V5.6...at.zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm V5.6 BypChat.zip

  • Size

    106.6MB

  • Sample

    241207-yafztsvmdj

  • MD5

    bbddcd512fcb1bf4efdb11987c45d861

  • SHA1

    9fcab4ae4f41f478e8b8eda82e19d7e37fffaf63

  • SHA256

    75eaf0cad1ec5a2d549238ad1dd05b1df911ba69dede4fcfd0aafa0aa01db8a0

  • SHA512

    8dcae5750daee9802eab794d82db0c8830a8772d9d9733a78d879481f9de3b634f410a75d83d17e2e956081fc7aa6f0d7611a33f715175dc1205a1be76341569

  • SSDEEP

    3145728:aU6Yky/N+O5V6HToU3usY7N6pzeWlDgal:V7N+On6HbesgN6MY

Score
10/10
stormkittyxwormratstealertrojan

Malware Config

Targets

    • Target

      XWorm V5.6 BypChat.zip

    • Size

      106.6MB

    • MD5

      bbddcd512fcb1bf4efdb11987c45d861

    • SHA1

      9fcab4ae4f41f478e8b8eda82e19d7e37fffaf63

    • SHA256

      75eaf0cad1ec5a2d549238ad1dd05b1df911ba69dede4fcfd0aafa0aa01db8a0

    • SHA512

      8dcae5750daee9802eab794d82db0c8830a8772d9d9733a78d879481f9de3b634f410a75d83d17e2e956081fc7aa6f0d7611a33f715175dc1205a1be76341569

    • SSDEEP

      3145728:aU6Yky/N+O5V6HToU3usY7N6pzeWlDgal:V7N+On6HbesgN6MY

    Score
    10/10
    stormkittyxwormratstealertrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks