stormkitty | 49cfb8c5850c4c77965c884ab028d5e2ad9b52961e4f4ae09c1270d60e05d6e0

Sharing

Copy URL Twitter E-mail

General

Target
Xworm.zip
Size 31.2MB
Sample260703-mcph7sct3r
SHA256 49cfb8c5850c4c77965c884ab028d5e2ad9b52961e4f4ae09c1270d60e05d6e0
MD5 e43f44020a824715fde196ee4b07b57e
SHA1 39456eadebcce3a6dabaf8d8789563650510e265
SHA512 f714e3ecfa1e3b5de9c4525754ab3abca620cd9beedfa7365a43ceecd88fd5fb01c056d2a660072e0c1f4266f1bc8c2d8492186c3a056cd194d58aa8151252ae
SSDEEP 786432:uC1XyzbswV56E0VMUnQwz/29X5CDOV8cHv3iPKVIpjIpIXrp00/:V1XyzbJUMUQwz/sXUDOV8c6yVCUI7S8
TLSH
T12B77334676DB4E0FEB74EF3E06697CF6735017D906809A482097494CACF3E881E27AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  XWorm V6.5/MySql.Data.dll
- Size 1.1MB
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH
  T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  XWorm V6.5/NAudio.dll
- Size 502KB
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH
  T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  XWorm V6.5/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  XWorm V6.5/Plugins/ActiveWindows.dll
- Size 14KB
- SHA256 3a8a40ff39f4921f62b7baf2b849a2239d339ae149a7dd36c05c73d617cec314
- MD5 791204e98ba176aaccccc2324e660e80
- SHA1 67d69444d169b869eb33e8c6b5fffe61f7d6e1ab
- SHA512 bf49708e5f342bb4f6f3f090ed0408669f241822fdc318e0c58cca733f165fe553460af44734366d725cad21f229e8da9db3a7a469a3622c65abbdf2c22f20fe
- SSDEEP 384:fRttr7olU5QrGPbONr3odT8ptsY7XZREDue:fRtuRrGPbHt0ZRED9
- TLSH
  T12C624A69E3E44335C6FE1FB25C7363001370C6088C47FB5E1ACCA2969D5BA9D8B91766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  XWorm V6.5/Plugins/Chat.dll
- Size 18KB
- SHA256 dbdfebd9a3a5c71629d13876a7392b11b8d45f148e8d6ab8b1509518be4cb7dc
- MD5 e0976c8b7a4282536a86a930afd80f0d
- SHA1 2682265d798a3ea7f6006ec1740d1c37a9ab4ea0
- SHA512 9dc6860d1a107ed9bdbb2e0006aaa49a9114306c334fc14f3584f1ae8c2d1a1b6a9c5d7c5b7192807f33f83bc7e1a521dc9649098b77a946d48b0b2c496bd898
- SSDEEP 384:+MOna4ifKQtuUvl0BY0iYUsBQcrwTKvh6GIKoImfWmWGfN:JKQtuq2Y0lUUvr0pImfWZ+
- TLSH
  T115821829539583B3C6FE2BF64D72E1A043B1D211CA07EF6FADDCB0AA49933528741791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  XWorm V6.5/Plugins/Chromium.dll
- Size 32KB
- SHA256 a7119232252ef75159f950639e781a0e4060c41a033b365fb87cc0f414daae0f
- MD5 3db4d508119e7a0251db0f4355d43010
- SHA1 fe6ae51ab370169018d2ec4f95d10dfaeca73507
- SHA512 1f42e5b4d544fa5865055f21c8934e96fd7f3286eb8da3255396bd4738752018c99b67839d2501f734f5c6532e6df77b778c04993a080903264b509efb6cc7d2
- SSDEEP 768:lSyQlmUmBlEuPuXfjq2sgDrNjfcVJ5sTVeEWqPkOV1sRduwbKhJLGEY3ZsmmR:0yQltmBlxuXfjq2sgDrNjfcVJ5sTVebu
- TLSH
  T1A7E2184873E8C654EEFF4E759C3965600372A0839D57F79D0AD1A0AA0BB3B908E51F93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  XWorm V6.5/Plugins/Clipboard.dll
- Size 14KB
- SHA256 b12f58cd1ce87933dd1115e1a0e3a8162ed91c619b5558ac444ca610debba96f
- MD5 9a8516a3245de4359c946608103e2f76
- SHA1 5f5b4ca4e6639e6bd51db1f7a09c2b30122752e4
- SHA512 96ab8ce7d62bc6f972d82af4ffafbec1354fbe112d3b11fb20f15557ef11566f9ae15afbc081be555d6943ff7805d2e3a75ba7fb8cbfc9bd72518210dbf7ec5b
- SSDEEP 192:fh23MhInehHXpqRxry1/X7eOFXgNTer149iY6IW1mX/YHXa77WLusU:eBeJGxy/X7eUSTe5Wi2X/f/sU
- TLSH
  T1B6522B9863E4837DC6FD0AB35C73B2401774C705EC02FF2E1DE860A15EA7A99871276A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  XWorm V6.5/Plugins/Cmstp-Bypass.dll
- Size 11KB
- SHA256 5b5f4dd71e4fcd7703670e888bf1d2eaf1a5c7834ddff50b869044b39a2e07da
- MD5 82bfe3551669209ba9ea264d41a17cd8
- SHA1 c3b9dd7cbec22d07f47605d4f3d740a8adea4020
- SHA512 05c6694bb725a0d02a5b5d2ffcc868e86b935778a048392bbe51c90f7a6b60d4cee9dcac3bcfceec026c5afd4c2fce11a4e19445f591b50cda2d0e5abbdd974a
- SSDEEP 192:KXpS1QWlPgiqdEquP+GGO9mWbpGkjgyaYcIW1vr/8T4U7aL7+WLEO0AhdW5:K5cjP20mWbEkUyaYir/o4JL7W8
- TLSH
  T1BF32082DA7E18275CD7E0E7248A7E3010771DA44DD23FB2F56E4A10A5D7B38883B2676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  XWorm V6.5/Plugins/DisableUAC.dll
- Size 1.3MB
- SHA256 6ae9de3990a79183c00057db035934ee0c6ded3a14e158262b7b7e69c9a098a2
- MD5 de3a0b88c7940650a74bb5e38b348b02
- SHA1 811368c07e379a3840393a0de6e5097b99ebdfdc
- SHA512 9833edf4ea1ca83234f203c8404e162c02924471570165d0d31fabe3684bc850e17d365d61e16805822104ba89904af4bcbd956e62482d97897144af2157ad2a
- SSDEEP 24576:hrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvai4M/ZtKP6cBDjvi/CZ:h2EYTb8atv1orq+pEiSDTj1VyvBatM/N
- TLSH
  T1C5559E0973A4419DFEABE177CA12C607D7B1784A0277862F01A4AB767F337715A2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  XWorm V6.5/Plugins/FileManager.dll
- Size 679KB
- SHA256 23d1928f053a511749ca73559b72c9b12eda4d9d4b742344a9703fb3ad7f585e
- MD5 00e28bd983b64578c9d23c2981d8b73c
- SHA1 25acd6550d09c1b1a15e3458120a13031dbda0a5
- SHA512 314fb89e2d4925ecd55b6fb50ec49d604d829bf1cc12bbce649976270441cb9d34934dcddf102d47262e32e29ff2ead4d8ea3b5170f89b312d6226443628b282
- SSDEEP 12288:xlr7BUE5n+/zlbI9gJvjDWKgpKhGOXoDDDp0b:xlB5n+/z1I9Sb8KhGO6DDp0b
- TLSH
  T1BCE409203FE8F01FE29A73B6D4D187214BB4A6427296FF8F258446E81C937895C594BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  XWorm V6.5/Plugins/FilesSearcher.dll
- Size 478KB
- SHA256 f6f9954f949d7708cbfae9ed6cc638446448498cdd5fc0d1eda479c39baa0c02
- MD5 90cb500d0b2f8ad17ebb81da5680ae2c
- SHA1 61fa0ffccaacfd23c92b9f27d09c402d11b30311
- SHA512 dc8986961cb54a2c69b29202bed550f4014e4e0b57d3dc36f6f21493a71be983e4530e83ce97f810b60119424375b2af50c18bbf0b2c377d242e15577f0239bc
- SSDEEP 6144:qAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/0uhg0BkyORUlKL5i+:rVUpnkZ7slS4Ys50ie6Cf3g0FT6s+
- TLSH
  T1A7A49D412BE8C647F1BF27B2C0E252A1C7B0E455A62EEBCF5D8424EE1D17350E9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  XWorm V6.5/Plugins/HBrowser.dll
- Size 25KB
- SHA256 a8ec5c5e44b81766bfa93eded535484d3f85fa026bda7a5492ab0665557b9e42
- MD5 02630e18ca44a1b38558156d0a6de6f1
- SHA1 d4813541cfcc106f190934d5392b5179d44073a2
- SHA512 dffa9a4c84d195349fb1e88fb097b77829cf557ee229bb59ca42cb28c588b6976b1016b382597d1fac31a624b009662db41765f7eceedb26a415074daacc16d7
- SSDEEP 384:Kp33X3L5/QrX8nB9d13+6HGLReMWaFnp9l/1DRVTbg0Ut4xh+7fYMoKABnR:KR3nL5/QrQ13ORR9bTbz+7YMoFBR
- TLSH
  T10FB25B4967F49630E1FD0A7598B367148370FA935812EF8F0BC9641A2E3B7E446247EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  XWorm V6.5/Plugins/HRDP.dll
- Size 1.7MB
- SHA256 35be9a19f1a0140133a1ca63a09e899a6a7f5f8616369ec89445c330ad287f6a
- MD5 4e75f5442c33f7651b38c38a8fabfe5b
- SHA1 4262124bdc079412b5cdf25d02ea6559b7afc3af
- SHA512 af4cfe48d7f5b571c8e5f80fe4e2797b0ad376d21f26acf16aa85668d5c86242803a1b60d3a290823c1bf3cba5a9108b17d4d1e84a9c4b882ed8e4efe15c37e4
- SSDEEP 24576:srKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:ZHZ5pdqYH8ia6GcKuR7
- TLSH
  T18D851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  XWorm V6.5/Plugins/HVNC.dll
- Size 85KB
- SHA256 a1a8d50eadd1f75200ca22d4cabfa6084c77db092973c9125412c1acfd08e531
- MD5 dc0edfb24acd1b371e68ccce1afcb6e6
- SHA1 1887adf4e1496c1c2f8cfd80206cc2856a63cab6
- SHA512 652d28b636d95cdc94c2512df42dfaab6d5a23c86164191914e044ebee67af38019914f025b8a9cd7a805d39b92fe1d4d93f01d71fea163e91e71308c7b55cf0
- SSDEEP 1536:4qhezATwSM9jwX0o71Us5XttkzU3mfICaRUlh:/hezVpjwRp5XttkzUMIC2Mh
- TLSH
  T179832889A3FC4610F1FF5B7598725A204BB1F5532932DB1F22E5906E2F777818920BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  XWorm V6.5/Plugins/HVNCMemory.dll
- Size 39KB
- SHA256 f1f362067d0e613b844e961c9b5c380f95cfa1333436e3431ee3accee1807804
- MD5 b4e4c31850ab3d32f71fabb658c77c26
- SHA1 2071c1d767d4fa868a1e48438d862a98b42b7251
- SHA512 4a9c506b24b6e3d0aa03a1d15244507318e1303c0f7790db735be4ed056488da39ccd07c27ec8b3617bd951335e670d1dd9d5131016b7c9d32236a05cf418533
- SSDEEP 768:xEyXMCBlQ6Kms0noGYMyKgDWj81Y6Mnx9oQog1zqGnf:xLXTa6bX81Y62o87
- TLSH
  T1A0034B4A77FA0221F1FE0AB5CC73A7289331F5934516D70E2AC960696B73682C510FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  XWorm V6.5/Plugins/HiddenApps.dll
- Size 45KB
- SHA256 3f24e2ed2972d3987bb189fe69830ab8a4ab56588db0ef0763145a78558abebd
- MD5 ed681170501c5728202e0eaef0c156e5
- SHA1 119eb6e56c58f0e5d7faa06a993be01db378804e
- SHA512 c32d3d21e3d1082c2b2063ce7d5703817376d8318c8720908ec38c64c3bfee1dac54a531c0537a66e0f5e65ce63c12a340ccc416f76b3ae76391dca2baa841f4
- SSDEEP 768:kEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ff+I1:kdmvWHVGMVwtYRtpl/x5qIXdEdX+w
- TLSH
  T1F2233848B7F88620E1FE1B3AA87363149374F4A71A16E74F0BC6A0592F723C45758BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32