Extracted

• • Target

    spf.exe

  • Size

    66.1MB

  • MD5

    2424c3fe215d77e8e460a8f6796de636

  • SHA1

    07b47f0878c5859b6681c6bd14cf2a464729f330

  • SHA256

    dba0c17d6101161862cb98fd0d5cc2c9c196ef3c561a6159d4df9cff2da4cc8f

  • SHA512

    52208cef403e4d36cd0704e8da0e159511a28ad972176e3dbc7fd47111cd4a5e0331d22df4f89d939b6a317d51345818f9bcc24219c9d0fc8818c005ecf7238a

  • SSDEEP

    1572864:nu43xWJUEl1vVvo3fXzU/Pymw7NtvPeJxHIa6p02SfkHn4HfQ:nu4BaUEPdvo3fXziqdNJ0H+0hkHMI

  Score

  10^/10

  xwormexecutionrattrojanstormkittydiscoveryevasionpersistencespywarestealer

  • Detect Xworm Payload

  • Disables service(s)

    evasionexecution

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2