Extracted

• • Target

    Bootstrapper.exe

  • Size

    2.0MB

  • MD5

    b9459d549b1b8457c7c1d5b9bce02af8

  • SHA1

    4cf9d5a422d3947186ea816d759738a2385847fd

  • SHA256

    9ec072826b39d6a5bc2b0d30f4b5130719006318114af5c374b3ef01f2d845e8

  • SHA512

    a74a98846f054c710b1e371bb0287f8887eda4a9cb568e30af89a5f6ed6e6014734452f4429ca1896d68a59b1973f6804db119279c4c8523056d232a93a5b42a

  • SSDEEP

    3072:IaJfX7TOQucdr/rdwepzCxeUdo9clZpZ7Tk0YN3r1tM4NpVq8BxFRzaqF+o2GQJ2:D7C4r/TFCxeUdo9cJxk04rsgVqwlL

  Score

  10^/10

  stormkittyxwormdiscoveryexecutionpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2