Extracted

Extracted

• • Target

    CraxsRat.exe

  • Size

    74KB

  • MD5

    4ede52da0203635e6710c5c2d342e9a2

  • SHA1

    85543afb17c7b8d5372e37fe436f8f1713535496

  • SHA256

    407811722d5d33124ac105789ae08fc00e50173292d90766b633babfa8243a05

  • SHA512

    d01509d737f6b6d4af14747bb8dc58f7225b91b6ca94204b9cae6ec30f8d4b7cfb944702da622cb1e4ede7aca20cb9c3adccb73b46144abe7676ae370e944f1d

  • SSDEEP

    768:CXnupU7ZFwUkBZq+OjCoPPupelf8/F1xlM5U+sarzcoODlXhwRyfIY63hGukQ7zp:8uBBZzOjOpGf893wE5h4yfIeYlww

  Score

  10^/10

  gurcustormkittyxwormdiscoveryexecutionpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1