Extracted

• • Target

    71c2d4c56eb76e1442548504cfc35af357ddaf95968e6a2f9ac60d804a40163c

  • Size

    1.1MB

  • MD5

    e10d4a9fb3f6cb40b721a883f5b21333

  • SHA1

    2593e6d56fe6c76216c026eaf44aa1fdb61137ff

  • SHA256

    71c2d4c56eb76e1442548504cfc35af357ddaf95968e6a2f9ac60d804a40163c

  • SHA512

    321137c35b903991c1653af0bf704dbe9c7ded42b941260a7a3222b0407d5dd91c593fca18ab599347fbcd985a29aafef45d97990c170c1f1dca4f04d59c22d0

  • SSDEEP

    24576:5nsJ39LyjbJkQFMhmC+6GD9c0P8j/svqA:5nsHyjtk2MYC5GDzP8j/Mq

  Score

  10^/10

  stormkittyxredbackdoorcollectiondiscoverypersistencespywarestealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2