Extracted

• • Target

    Startup.exe

  • Size

    41KB

  • MD5

    5e70c383a38d3ecc7d779bc76e61753f

  • SHA1

    4d94fe4fc00e52703fbe15d18e85998f6a92e053

  • SHA256

    bb3d1286bb2b5bc25e0818fca4a7d4f18e0a818cf543dd7819ca99937f7966df

  • SHA512

    17436a0501449867f1f0482357ac5a7c8cc706b69ddb11ed26ba68153aabb027bd7fc78ba6731378c72777acca0ef4199c5f3049b06472dd49a930909729771c

  • SSDEEP

    768:TcAz60wqEL3OixHL1s7LZy69wF19j5Q6EO9h0LV:TcAz60K/xHLG7LZaF19j5Q6EO9EV

  Score

  10^/10

  xwormcredential_accessexecutionratspywarestealertrojanstormkittydiscoverypersistence

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2