Extracted

• • Target
    XClient.exe
  • Size 33KB
  • SHA256 a7d98b372c82cfbbb3374a4f0cc1c5d77f1e1863d855f3b8db92371aa463184c
  • MD5 eb9503857b9ee9ed8a05d85b7ee991a6
  • SHA1 48a18b10d325bde8ac3d2a8f92062ac21d409165
  • SHA512 2f9b156c28128dd529422c3425cebfb26555b1465d7d4e420a12fcfadefe4fd3205b2dd8db88ca8c2c47dd9a56d59780f57e9e0ccbf1422613126513879ba9a9
  • SSDEEP 384:54x3Mxjol+9Ul1L9d5zLwP+hzGTUUA5ApkFyHBLT/OZwpG2Tv99Ikcisc6VFxOjP:rxpg597nw4+jAdFyZ9F1IOjhQSJX
  • TLSH
    T180F24B0877904226D6EE7FF0A8F372064674D617D913EF9E0CD585EB6F67AC08A403A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionstormkittyxwormransomwareratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • StormKitty payload

  • UAC bypass

    defense_evasiontrojan

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1