stormkitty | 013d9d6ca6d999827657eb3cd1824f9771cf2020739a692509af1f54fa8e89f9

Sharing

Copy URL Twitter E-mail

General

Target
Xworm.rar
Size 33.8MB
Sample260708-e227labv9j
SHA256 013d9d6ca6d999827657eb3cd1824f9771cf2020739a692509af1f54fa8e89f9
MD5 d8fc02aab0554a4bcb47418919c9119a
SHA1 01bced3b4910a850905eec07aadeb6c911efe512
SHA512 6ad1eec79050a8cf0e039cd30c0a579a84f0eb52e1270023e42ceed730dfbc58d93d44fe21583de766996d3b50cbf94083b41918aa508231dc2aeb8b361c9c21
SSDEEP 786432:5/yavAzJO7ttPSx19x2igwpVMJJ10GeOeFQcfY4sa2OB:oavIYP49x2igwgd0G7QQf4saj
TLSH
T18F7733F4E032F74891354A169A90F79E176F331552116AE6A3DB4C8E88EED3DD1EE302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Xworm.rar
- Size 33.8MB
- SHA256 013d9d6ca6d999827657eb3cd1824f9771cf2020739a692509af1f54fa8e89f9
- MD5 d8fc02aab0554a4bcb47418919c9119a
- SHA1 01bced3b4910a850905eec07aadeb6c911efe512
- SHA512 6ad1eec79050a8cf0e039cd30c0a579a84f0eb52e1270023e42ceed730dfbc58d93d44fe21583de766996d3b50cbf94083b41918aa508231dc2aeb8b361c9c21
- SSDEEP 786432:5/yavAzJO7ttPSx19x2igwpVMJJ10GeOeFQcfY4sa2OB:oavIYP49x2igwgd0G7QQf4saj
- TLSH
  T18F7733F4E032F74891354A169A90F79E176F331552116AE6A3DB4C8E88EED3DD1EE302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  XWorm V6.0-CrackedBy@FOX/NAudio.dll
- Size 502KB
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH
  T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  XWorm V6.0-CrackedBy@FOX/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/ActiveWindows.dll
- Size 1.6MB
- SHA256 5d7d2f09b0f9e274f64ee35d4fd986668bb9cb938cf6c44253634e284fc0e921
- MD5 e3c0e4bec40771d80bb3e3932fa88ba7
- SHA1 6ba82ab518dbd7ad6588c5b64965e741f40fcc5b
- SHA512 ea473e2de9aa3818d5e37d4c5b6ada48e74128cd66f2235c2143d1dee67c17aef4e7b93d2719f930bd9163262bf59a5643973476dc2343e15734f32452a13483
- SSDEEP 24576:lCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:c7uRfbQswUZcSByYGv5u
- TLSH
  T17A759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/Chat.dll
- Size 1.6MB
- SHA256 7c64c646d22f95d109e9832c7245d38a1484bdca1ddf14b544e6555448cdd513
- MD5 6a06c28ead10e020f4dafac0423fd9cd
- SHA1 eb11db4d8820b80ca0f83d8fe011399abdaf8180
- SHA512 a1ba0ce614b41b629815b8db8974ee14c9cf6c4a930b02ec3bdb38fee05f05788c0d671d120f685259ce743b6c2d5e02eb9051f9d07381775b0ab9cf71bcfc34
- SSDEEP 24576:ICs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:T7uRfbQswUZcSByYGv5u
- TLSH
  T122759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/Chromium.dll
- Size 1.6MB
- SHA256 2b2dfd13b40c5a7dd3754d43f07410052b3894fb80d75a7e7fecf2cb5300b90b
- MD5 79bf02ce63e67e0a9f6a8934bf6f343a
- SHA1 a25e2270ee4a3fd599c04ca9e34c2e46c3a04656
- SHA512 d03dd276f78fa57e8400c58c39c72c49c959920a152b8c8673b771c5947698df0cb36a3313dba162935bb66d4ae78fbeef85ef11cfce36cfc459c0bbd70dd75a
- SSDEEP 24576:HCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfC:i7uRfbQswUZcSByYGv5u
- TLSH
  T1F875AF62B69AC1BAD4ED80B9897B961EF7B6784407348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/Clipboard.dll
- Size 1.6MB
- SHA256 04b560b045ce83e4ecc6d052080d4263e590cf67409a38f31f6bbd7324dadb8b
- MD5 aef1b7f2665da23fa6449036ba64fe33
- SHA1 ebc4088171e554b0368155501d3c3d2f4b4c3ab6
- SHA512 a635cf53e870f1eba44ca2fc111a6d951b5b0e2d1641b0486b580dcea04f461e9faf77c63e4c6092d4636a0db3c7d8a1563e1fc6cf3128eaec0ec1d172b77b94
- SSDEEP 24576:jCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:u7uRfbQswUZcSByYGv5u
- TLSH
  T120759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/FileManager.dll
- Size 2.3MB
- SHA256 15d73e99263c2c88731cbb4b915f6de55dde33d06556fb75b5f41adde7fd3134
- MD5 c176399595eb243d5acdcf35a80f5d81
- SHA1 be9d1d8a1bdc3c3cef42aecce77947fc3a6f5737
- SHA512 3f21a8d4a63853370a0e47e8a91d697a1ff96219babb226cdf66cad3e6728a06a40fca7ff50c12678eab7896d9da3dbc17f1dab3ab42d6374933b1b43e81f5e9
- SSDEEP 24576:B0UvjCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfjLy8Vbh7MGWM33:Bdvu7uRfbQswUZcSByYGv5uRy8V7ICa
- TLSH
  T1BCB5AE2277AAC17FE0BE41B5947A862AE7B274410761DFCF12D4167D1EA33E01E39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/FilesSearcher.dll
- Size 2.1MB
- SHA256 5b2e35024b7d1f7369d0ff09a6d765958f8a8a37fa5016e95874943430269dd6
- MD5 ce7e4278984ab5aae85023aa7052fd0a
- SHA1 d6771d70b6b5e97f0d313ca9c3dc7c19734dc584
- SHA512 1beda73bbccb2ce9b0f8d99f35c8e3ba325d982cae82357d5efebf7e8e16fb206922a9c1ea78a4cd07d95ce0d61ab3cf6d8fcb97332bc7d592cc47a2b7a5bcdc
- SSDEEP 49152:EL5R4mjF7uRfbQswUZcSByYGv5u7NX1+q:EL5Sm57ul5ZNl
- TLSH
  T19FA5BF22B6D9C1BAD0FE42B984BB955AE7B178440B38CBDB12D4166E1E337D05E39313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/HBrowser.dll
- Size 1.6MB
- SHA256 f3a1ddea6cce676bfa3f0bd2507fff9c34764879862be3d0d944b8c07d0f09c4
- MD5 b922fb5a11ce558131809f9953acc166
- SHA1 ecff9c78fe454b443640e6bab2fed5d7b35957b1
- SHA512 fe408fddd4049e352d4e3b33d074b0ddf9f39f02b6da5cdf7f5c8f8285287a06f74c94cc99973beb62abc36f69f61ca558b06ba5450f9f0a5d594ee20b71342a
- SSDEEP 24576:yCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:57uRfbQswUZcSByYGv5u
- TLSH
  T103759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/HVNC.dll
- Size 1.6MB
- SHA256 51e642ccb7d17770ee4c34077f95f4b15108bfa6380ef2e1caa3ff80b49721d3
- MD5 1369a5fd749e7a51d100bd1085c66a5b
- SHA1 485c22638cf0bdc51a67ad449ad2e8d2a94722d1
- SHA512 ceb35de42fbde0f34f0a2d32a792b890c1000f0b4d2089ef5fc568d02fd38eb723665ae18c210e600b5f1a191b117d8b75a568c5091c899b46769e540b445db8
- SSDEEP 24576:rCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfv:m7uRfbQswUZcSByYGv5uF
- TLSH
  T16D759F62B69AC1B9D4EE80B9897B961EF7B6784407348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/HVNCMemory.dll
- Size 1.6MB
- SHA256 c51a6c2aae865c8e7ca285b8403237b1975738a22c89e6a91d388535ae21823c
- MD5 d54ca2b00cfdd43647886433ddf78f9b
- SHA1 be70d01429652eaac90616bd096e976158e0d2f7
- SHA512 486ad36b1ef32b40b7c8aee89e0aaa00a71dc8cd054733ccec64bc5bdb57c3826a1063ea8a13a4ee3fa9b11a4266b52d8daa3f354aed08330aeaca2cddb539fd
- SSDEEP 24576:zCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfCK1K:e7uRfbQswUZcSByYGv5u
- TLSH
  T119759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/HiddenApps.dll
- Size 1.6MB
- SHA256 1cc5ed0227aff0a8066c2a34ab08e3e1605910ab87d48538efd0e3d7bcf8cb49
- MD5 01a90b36d48786a321983f09d350d163
- SHA1 44eddb6bd9a1312edd560aaf4a59caf62a613765
- SHA512 6cf35bd7f0edd34db5dc1a90add61ee5527a99f0ccff8c146cbe1160cb71bab0e30e11c90f029870c75c128014db6963e4a8820035c009e809b2614ef705c999
- SSDEEP 24576:MrCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfsxY:17uRfbQswUZcSByYGv5uy
- TLSH
  T134759062B69AC1BAD4EE40B9897B961EF7B6784407348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/Informations.dll
- Size 1.6MB
- SHA256 170281e79fcdfaab997e001c43b40b0c263074d3470be4dd355a7c9a5a187c8c
- MD5 f023b857d9f5d127a9f6e8a1557aa6a9
- SHA1 da15b624c95b5263334b2f1b2c2c5db258ac125a
- SHA512 dcabed2dc5835706ad5358d564ce3a566e9ea1baab15a43816e41366c9cbdd771ee27d733148f587afab26e1f19d6248dbc8c6e21f7367fd4f0bbe497aed0c8b
- SSDEEP 24576:ZCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:w7uRfbQswUZcSByYGv5u
- TLSH
  T1FB759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/Keylogger.dll
- Size 1.6MB
- SHA256 9389ca12e6f0d9657ae4193d038c8dea8717f171340f56c3b1c078cfe4f3b290
- MD5 9eb8553f45e2aa12d296231a669e3793
- SHA1 8161c51a75456fddb71dbc431db3a4d307618df4
- SHA512 5f6b34ea6bc6a8a223aaca14cbe97c513984fd9b7b657d45d60b6991ea2a48a09082c085b930cd99df1d8497117a486efe3d475de05c3a401a3b28884bf708ab
- SSDEEP 24576:SCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfs:Z7uRfbQswUZcSByYGv5u
- TLSH
  T195759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  XWorm V6.0-CrackedBy@FOX/Plugins/Maps.dll
- Size 1.6MB
- SHA256 9368027ce3cbe90de668959b5adae236d0c9d75edc6d3cd2b69523bfee7a532e
- MD5 a7384453e5e7897c2e751997f2c4bf4c
- SHA1 4fb8777a6aafd32662381f213ced42adddcfe258
- SHA512 d84b16bde3b847ff2c3ef198734e0c1789abfcf31438178b758e4e02899bfa219152840cc4100090c056d1558028e6f0f0acbd01d9ba4a7714f02b7abe5b51f7
- SSDEEP 24576:zbCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfQmB:z27uRfbQswUZcSByYGv5u5
- TLSH
  T15C759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32