Extracted

• • Target

    XClient.exe

  • Size

    35KB

  • MD5

    8e2004dd32bda2b26546d940697f2e74

  • SHA1

    54cb59c5b9089563417da7ba32a585b5fd249472

  • SHA256

    7f175bde58843224ac7eb5b1d872e4d6189bbd4e529210c93747815f27272705

  • SHA512

    35a01e5376db084f3a07942edf064df7d18e223416f1f3035fb85b8c726ff6b95f786eb050d7d9bfa29a030fc761b63ded46d7163c9ed6ae0e025ef7c267117a

  • SSDEEP

    384:KImOlrq3Qq8K+kSk12XFKFi1q8QchnN6V/JXpXwxGLZfi5cnsrT7iJiUE/o58pk4:qZ/YXygNA5ILvEiLoVFyw9zZdO/hCyP

  Score

  10^/10

  stormkittyxwormdiscoveryratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2behavioral3