Extracted

Extracted

• • Target
    2026-04-05_61530fcb63bb8b25aaff4548f2b8b0c4_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 15.0MB
  • SHA256 84773f47d66d9bd625115933b800d5e1beefa3f4147f5a3f29e476e2bda0af87
  • MD5 61530fcb63bb8b25aaff4548f2b8b0c4
  • SHA1 6800da1fe57212638aaa3f181fb811587580688d
  • SHA512 ef2eecedf0a60ab40bdc5ddb8d31fcf090974e97bfdcf872a91f088e59e026b756f62073985ab07ec5b352c61b209451a5dc74208bff49eddd8175cf5e1ca842
  • SSDEEP 24576:2bQfQjWKM072B6W7unuCFlAJCOE2tXFzgZXCjpvQcghuG0543LdQt8E0:4QfiZ7qJCu0Gq2txDQcgol54BrE
  • TLSH
    T17AF6E109E7EC04F8F0B7A2B899A24902E777785D1771D78F07AC46561F732A09E39B21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects executables containing URLs to raw contents of a Github gist

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2