stormkitty | e4208de47bd3293d69fed65c47de8020f4931e3ab08e2c3dee0e9b1ea15dc94b

Sharing

Copy URL

Twitter E-mail

General

Target

Xworm-V5.6.zip
Size

24.9MB
Sample

250212-xm3hxstjfn
MD5

c22e03f94dec14d4bd32cd2e799c105f
SHA1

4f9ef5352d31411cfa1fa965e6489473c449f1bf
SHA256

e4208de47bd3293d69fed65c47de8020f4931e3ab08e2c3dee0e9b1ea15dc94b
SHA512

c7736702e2e208041843b07e4814ce0fec8e42ed654aee46676c4fef6aea7b4f08a58cfd27731e866e7241be4b508e037e9c752ac99a8ac7ba78845e0c818bb2
SSDEEP

786432:iCIgXirCT0kw0j0XIstCbAfoJpVPH2a2UxfDfgSnVh:VXirCTvbjvsteAfoJpV+a2UxfDfgSX

Score

10^/10

Malware Config

Targets

- Target
  
  Xworm-V5.6/FastColoredTextBox.dll
- Size
  
  333KB
- MD5
  
  b746707265772b362c0ba18d8d630061
- SHA1
  
  4b185e5f68c00bef441adb737d0955646d4e569a
- SHA256
  
  3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- SHA512
  
  fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP
  
  6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral1 behavioral2
- Target
  
  Xworm-V5.6/Fixer.bat
- Size
  
  122B
- MD5
  
  2dabc46ce85aaff29f22cd74ec074f86
- SHA1
  
  208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA256
  
  a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- SHA512
  
  6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral3 behavioral4
- Target
  
  Xworm-V5.6/GMap.NET.Core.dll
- Size
  
  2.9MB
- MD5
  
  819352ea9e832d24fc4cebb2757a462b
- SHA1
  
  aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA256
  
  58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- SHA512
  
  6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP
  
  49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral5 behavioral6
- Target
  
  Xworm-V5.6/GMap.NET.WindowsForms.dll
- Size
  
  147KB
- MD5
  
  32a8742009ffdfd68b46fe8fd4794386
- SHA1
  
  de18190d77ae094b03d357abfa4a465058cd54e3
- SHA256
  
  741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- SHA512
  
  22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP
  
  3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral7 behavioral8
- Target
  
  Xworm-V5.6/Guna.UI2.dll
- Size
  
  1.9MB
- MD5
  
  bcc0fe2b28edd2da651388f84599059b
- SHA1
  
  44d7756708aafa08730ca9dbdc01091790940a4f
- SHA256
  
  c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- SHA512
  
  3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP
  
  24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral10 behavioral9
- Target
  
  Xworm-V5.6/IconExtractor.dll
- Size
  
  10KB
- MD5
  
  640d8ffa779c6dd5252a262e440c66c0
- SHA1
  
  3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA256
  
  440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- SHA512
  
  e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP
  
  192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral11 behavioral12
- Target
  
  Xworm-V5.6/NAudio.dll
- Size
  
  502KB
- MD5
  
  3b87d1363a45ce9368e9baec32c69466
- SHA1
  
  70a9f4df01d17060ec17df9528fca7026cc42935
- SHA256
  
  81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- SHA512
  
  1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP
  
  6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
Score

6^/10

adware discovery persistence privilege_escalation stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral13 behavioral14
- Target
  
  Xworm-V5.6/Newtonsoft.Json.dll
- Size
  
  695KB
- MD5
  
  195ffb7167db3219b217c4fd439eedd6
- SHA1
  
  1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA256
  
  e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- SHA512
  
  56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP
  
  12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral15 behavioral16
- Target
  
  Xworm-V5.6/Plugins/ActiveWindows.dll
- Size
  
  14KB
- MD5
  
  5a766a4991515011983ceddf7714b70b
- SHA1
  
  4eb00ae7fe780fa4fe94cedbf6052983f5fd138b
- SHA256
  
  567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52
- SHA512
  
  4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8
- SSDEEP
  
  384:vRt5r7olU5QrGPbMrodT8ptsY7XZ1EDI6:vRtSRrGPb9t0Z1ED7
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral17 behavioral18
- Target
  
  Xworm-V5.6/Plugins/Chat.dll
- Size
  
  18KB
- MD5
  
  59f75c7ffaccf9878a9d39e224a65adf
- SHA1
  
  46b0f61a07e85e3b54b728d9d7142ddc73c9d74b
- SHA256
  
  aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492
- SHA512
  
  80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8
- SSDEEP
  
  384:4MOna4ifKQtuUvl0BY0iYUsBG/crwTKvh6GIKoIafWUWmfN:vKQtuq2Y0lUUG0r0pIafWXe
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral19 behavioral20
- Target
  
  Xworm-V5.6/Plugins/Chromium.dll
- Size
  
  32KB
- MD5
  
  edb2f0d0eb08dcd78b3ddf87a847de01
- SHA1
  
  cc23d101f917cad3664f8c1fa0788a89e03a669c
- SHA256
  
  b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982
- SHA512
  
  8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3
- SSDEEP
  
  768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral21 behavioral22
- Target
  
  Xworm-V5.6/Plugins/Clipboard.dll
- Size
  
  14KB
- MD5
  
  831eb0de839fc13de0abab64fe1e06e7
- SHA1
  
  53aad63a8b6fc9e35c814c55be9992abc92a1b54
- SHA256
  
  e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959
- SHA512
  
  2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee
- SSDEEP
  
  192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral23 behavioral24
- Target
  
  Xworm-V5.6/Plugins/Cmstp-Bypass.dll
- Size
  
  11KB
- MD5
  
  cf15259e22b58a0dfd1156ab71cbd690
- SHA1
  
  3614f4e469d28d6e65471099e2d45c8e28a7a49e
- SHA256
  
  fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b
- SHA512
  
  7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38
- SSDEEP
  
  192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral25 behavioral26
- Target
  
  Xworm-V5.6/Plugins/FileManager.dll
- Size
  
  679KB
- MD5
  
  641a8b61cb468359b1346a0891d65b59
- SHA1
  
  2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0
- SHA256
  
  b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd
- SHA512
  
  042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee
- SSDEEP
  
  12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral27 behavioral28
- Target
  
  Xworm-V5.6/Plugins/FilesSearcher.dll
- Size
  
  478KB
- MD5
  
  6f8f1621c16ac0976600146d2217e9d2
- SHA1
  
  b6aa233b93aae0a17ee8787576bf0fbc05cedde4
- SHA256
  
  e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b
- SHA512
  
  eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a
- SSDEEP
  
  6144:ZAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/Quhg08OwR75:yVUpnkZ7slS4Ys50ie6Cfzg0M
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral29 behavioral30
- Target
  
  Xworm-V5.6/Plugins/HBrowser.dll
- Size
  
  25KB
- MD5
  
  f0e921f2f850b7ec094036d20ff9be9b
- SHA1
  
  3b2d76d06470580858cc572257491e32d4b021c0
- SHA256
  
  75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c
- SHA512
  
  16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3
- SSDEEP
  
  384:tp33X3L5/QrX8nB9d13+6HcLReMWaFnp9l/1DRVTbg0Ut4xh+TfYMoKAB1R:tR3nL5/QrQ13kRR9bTbz+DYMoFBf
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Boot or Logon Autostart Execution: Active Setup

Downloads MZ/PE file

Installs/modifies Browser Helper Object

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

Downloads MZ/PE file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32