Extracted

• • Target

    XWorm V5.2.rar

  • Size

    30.2MB

  • MD5

    d46700f59429076e678aa91993165c4d

  • SHA1

    86e9e091021d1c87eb32a406261063362fc7aa0f

  • SHA256

    ba02819b258dd8fb8d5a649d45535189d3dd19e15ca12aa2ccc83bc2162ad0c4

  • SHA512

    b265ab5797b350bdee2798784eea56fa5d6ddccbc230ca3d8fb3874748a423a7ac292721a7259e03de1a055ad4bb1f381b32535882a4f52341184ec78baa636b

  • SSDEEP

    786432:AyEdI35cJuWL9qeVCp3K7cLpeEJfi2I7auNJuaaJxyXzmn:AI35crZlVCphFrfi37HPnjmn

  Score

  10^/10

  stormkittyxwormagilenetpersistenceratstealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence
  behavioral1