Extracted

• • Target

    CookieScript.exe

  • Size

    70KB

  • MD5

    db991a8bbad955983d68121fea62aa1a

  • SHA1

    d103e2def0fb83b53edc95e81eb4e7e7a33f46f9

  • SHA256

    b47e2ebd5df87d6fe2b540f94aa188eae6f45f0df94815c35d4f2a9e4db08f38

  • SHA512

    f2a60a290c5079e559d8e1d3210822a1a8f01d6d5c3bea5863038fe489b44d9e368d7adb5646e4c9004a5d8500ca1de95240340336fb4635c4bf96feb004a00b

  • SSDEEP

    1536:sQJ+vIofChluDAR7D9Iqtd+b3XhWkODXfzHbiOeUI:s1VKhl4A19Xf+b3XhEreOeZ

  Score

  10^/10

  stormkittyxwormdiscoverypersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2