Extracted

• • Target

    quest mod installer.exe

  • Size

    165KB

  • MD5

    6b223bcb2346baac936dc94b8fbc0e80

  • SHA1

    672fb1856a64c9d71d438e9beaf8094aeb65e4cb

  • SHA256

    573b2ca9df39dc24d7e769786b7fd1bcafda80c2b7404b919e92cbbc65db9baf

  • SHA512

    2c22c62be5490383f29ea1b9023dbffce9f0d9a36431bbbc494d29e041896758878f729539abc793e2ae5e3ef4b27666e50064b11a284a7ef9d27c2c57a77443

  • SSDEEP

    3072:UvRZfiACBoHbT0/h5dOMpkMZ0Bz65/M6If+3Js+3JFkKeTnC:UvRZfiIbwhFHZ0xBt25

  Score

  10^/10

  stormkittyxwormdiscoveryratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2