stormkitty | 1a0ec5c80430edda2736c5e4dad4083bdcd78a097778a0b85c241bef87e6bdfd

Sharing

Copy URL Twitter E-mail

General

Target
XWorm 6.5.rar
Size 28.2MB
Sample260819-bmfs9scd45
SHA256 1a0ec5c80430edda2736c5e4dad4083bdcd78a097778a0b85c241bef87e6bdfd
MD5 71d3e0e7722094f78fc2ec58d957f77b
SHA1 932563bf2c934b0c997e17247878dbe9a3a4bb09
SHA512 eca70bef2f6a2fb973ab4312e74064ed1adcead7422465448df9e6c1839320dbf0ae17c664bd5d96ca48743cb558ec76d3340083b478338547c923df894bebda
SSDEEP 786432:Gb7Wn+89MqA3ikFMojXg4iFfxEacSaO3i5U:Gb8+ixAfFJXgFfeacpo5
TLSH
T1D657330BDA86187E18E774930AD8B0EDA0E17144687E40B1E59178BC7DDB09BA5CF2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

XWorm V6.5 by c3lestial.fun

portbuddy.dev:40528

Mutex

oISLLcnhxNkZUBVl

Attributes

Install_directory
%LocalAppData%
install_file
WindowsUpdate.exe

aes.plain

Targets

- Target
  XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260426.txt
- Size 814KB
- SHA256 ba3f372e635f8a4fffca86a752bbefdb4b523623a7247a49632becbf78a558c9
- MD5 18ee05b847561fc07576ab5fca68f3c6
- SHA1 38f69221181f219d78ee7135ebd1a8a48e35acae
- SHA512 1bbfcf5aad42083d45cf4aafff688976332ce03c80ab85b36683a421a3a66820396eafdb1156fc2bb62dce6c51f678a9607bae91385569caf31ff3ef8ac7889e
- SSDEEP 12288:NV+/i01a/SStHI/i01a/SShE/i01a/SSc/i01a/SSI1Y01a/SSmWi01a/SS0/i0I:NV3Hcyr+
- TLSH
  T1F805E91B951638115B35A251B27116C376BD331B72848AE6BFFC6D8E1FA3302D2E4B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260427.txt
- Size 522KB
- SHA256 dfe3fc8a37d599f4af323de1e24db1fce3043859238307b8f6240b83472e2a0c
- MD5 1b2e2a015e7cce934c53bdef1caa624c
- SHA1 10dd0d39bfd3922f321e0bf89bc69d97634143b9
- SHA512 580fb5e98c0fd2c71fcfe47dac333ee37f39634f727c8ab6f58ba4fbc4628502bb40dfae146b137ab73dcd0eac53510e27c668f3ab1910b33a9b183747b1754e
- SSDEEP 12288:sLKA0Wi01a/SSvWi01a/SSGWi01a/SSPWi01a/SSD/i01a/SSCm1X9HWi0iF/SSt:sLKAot96+F
- TLSH
  T167B4E726941A3451A675A242F27126C7AAAD335B73800FF3BFFD5D8D1FA3202D1E1A35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260428.txt
- Size 169KB
- SHA256 d1460ee40d7d79a1b94e5233857c2c998bb8b6eee320ef0fd60dbb47ca80f812
- MD5 0d14b8859af4c0233b3453438e8bdf37
- SHA1 13198c69e38992fa35e3ae181ff83aaa60568adb
- SHA512 2048d5fa2c110b5b0e7cadfa291c485797f04d5c642defefb6519a03ced7702042285e524f6c916a783aff7bd41d3ab2ea432f6be78b9f472b2fb529dc997dc3
- SSDEEP 3072:eGili+id2xWqf/ili+90rWO8lili+1utWilr+Kl2:eU+id2cqfz+90rF8V+1utl+Kl2
- TLSH
  T1D204961F185F2C998336C192E3228BC76B2D50F5758814F9F59DCCCD2A8B29A93D5E32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  XWorm 6.5/FastColoredTextBox.dll
- Size 333KB
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH
  T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  XWorm 6.5/Fixer V6.bat
- Size 122B
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH
  T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  XWorm 6.5/GMap.NET.Core.dll
- Size 2.9MB
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH
  T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  XWorm 6.5/GMap.NET.WindowsForms.dll
- Size 147KB
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH
  T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  XWorm 6.5/MySql.Data.dll
- Size 1.1MB
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH
  T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  XWorm 6.5/NAudio.dll
- Size 502KB
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH
  T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  XWorm 6.5/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  XWorm 6.5/Plugins/ActiveWindows.dll
- Size 14KB
- SHA256 3a8a40ff39f4921f62b7baf2b849a2239d339ae149a7dd36c05c73d617cec314
- MD5 791204e98ba176aaccccc2324e660e80
- SHA1 67d69444d169b869eb33e8c6b5fffe61f7d6e1ab
- SHA512 bf49708e5f342bb4f6f3f090ed0408669f241822fdc318e0c58cca733f165fe553460af44734366d725cad21f229e8da9db3a7a469a3622c65abbdf2c22f20fe
- SSDEEP 384:fRttr7olU5QrGPbONr3odT8ptsY7XZREDue:fRtuRrGPbHt0ZRED9
- TLSH
  T12C624A69E3E44335C6FE1FB25C7363001370C6088C47FB5E1ACCA2969D5BA9D8B91766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  XWorm 6.5/Plugins/Chat.dll
- Size 18KB
- SHA256 dbdfebd9a3a5c71629d13876a7392b11b8d45f148e8d6ab8b1509518be4cb7dc
- MD5 e0976c8b7a4282536a86a930afd80f0d
- SHA1 2682265d798a3ea7f6006ec1740d1c37a9ab4ea0
- SHA512 9dc6860d1a107ed9bdbb2e0006aaa49a9114306c334fc14f3584f1ae8c2d1a1b6a9c5d7c5b7192807f33f83bc7e1a521dc9649098b77a946d48b0b2c496bd898
- SSDEEP 384:+MOna4ifKQtuUvl0BY0iYUsBQcrwTKvh6GIKoImfWmWGfN:JKQtuq2Y0lUUvr0pImfWZ+
- TLSH
  T115821829539583B3C6FE2BF64D72E1A043B1D211CA07EF6FADDCB0AA49933528741791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  XWorm 6.5/Plugins/Chromium.dll
- Size 32KB
- SHA256 a7119232252ef75159f950639e781a0e4060c41a033b365fb87cc0f414daae0f
- MD5 3db4d508119e7a0251db0f4355d43010
- SHA1 fe6ae51ab370169018d2ec4f95d10dfaeca73507
- SHA512 1f42e5b4d544fa5865055f21c8934e96fd7f3286eb8da3255396bd4738752018c99b67839d2501f734f5c6532e6df77b778c04993a080903264b509efb6cc7d2
- SSDEEP 768:lSyQlmUmBlEuPuXfjq2sgDrNjfcVJ5sTVeEWqPkOV1sRduwbKhJLGEY3ZsmmR:0yQltmBlxuXfjq2sgDrNjfcVJ5sTVebu
- TLSH
  T1A7E2184873E8C654EEFF4E759C3965600372A0839D57F79D0AD1A0AA0BB3B908E51F93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  XWorm 6.5/Plugins/Clipboard.dll
- Size 14KB
- SHA256 b12f58cd1ce87933dd1115e1a0e3a8162ed91c619b5558ac444ca610debba96f
- MD5 9a8516a3245de4359c946608103e2f76
- SHA1 5f5b4ca4e6639e6bd51db1f7a09c2b30122752e4
- SHA512 96ab8ce7d62bc6f972d82af4ffafbec1354fbe112d3b11fb20f15557ef11566f9ae15afbc081be555d6943ff7805d2e3a75ba7fb8cbfc9bd72518210dbf7ec5b
- SSDEEP 192:fh23MhInehHXpqRxry1/X7eOFXgNTer149iY6IW1mX/YHXa77WLusU:eBeJGxy/X7eUSTe5Wi2X/f/sU
- TLSH
  T1B6522B9863E4837DC6FD0AB35C73B2401774C705EC02FF2E1DE860A15EA7A99871276A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  XWorm 6.5/Plugins/Cmstp-Bypass.dll
- Size 11KB
- SHA256 5b5f4dd71e4fcd7703670e888bf1d2eaf1a5c7834ddff50b869044b39a2e07da
- MD5 82bfe3551669209ba9ea264d41a17cd8
- SHA1 c3b9dd7cbec22d07f47605d4f3d740a8adea4020
- SHA512 05c6694bb725a0d02a5b5d2ffcc868e86b935778a048392bbe51c90f7a6b60d4cee9dcac3bcfceec026c5afd4c2fce11a4e19445f591b50cda2d0e5abbdd974a
- SSDEEP 192:KXpS1QWlPgiqdEquP+GGO9mWbpGkjgyaYcIW1vr/8T4U7aL7+WLEO0AhdW5:K5cjP20mWbEkUyaYir/o4JL7W8
- TLSH
  T1BF32082DA7E18275CD7E0E7248A7E3010771DA44DD23FB2F56E4A10A5D7B38883B2676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  XWorm 6.5/Plugins/DisableUAC.dll
- Size 1.3MB
- SHA256 6ae9de3990a79183c00057db035934ee0c6ded3a14e158262b7b7e69c9a098a2
- MD5 de3a0b88c7940650a74bb5e38b348b02
- SHA1 811368c07e379a3840393a0de6e5097b99ebdfdc
- SHA512 9833edf4ea1ca83234f203c8404e162c02924471570165d0d31fabe3684bc850e17d365d61e16805822104ba89904af4bcbd956e62482d97897144af2157ad2a
- SSDEEP 24576:hrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvai4M/ZtKP6cBDjvi/CZ:h2EYTb8atv1orq+pEiSDTj1VyvBatM/N
- TLSH
  T1C5559E0973A4419DFEABE177CA12C607D7B1784A0277862F01A4AB767F337715A2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32