Extracted

• • Target
    2026-04-15_6519a93d81f5198769d6c2fe86640666_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 623KB
  • SHA256 762490d920b05018dc98bd36501bc8aedc8e3c4a6e2c135d8c5d287b82265458
  • MD5 6519a93d81f5198769d6c2fe86640666
  • SHA1 f34bfd85ce73c873dc135cb6c245aac454e0c759
  • SHA512 bf73110d6bf2a868b3a8393fdcaec6fd770df5d244e87ac01161d366a998c13abfb6890b0bbf85ae03b3fe346ca336a2acaf75561ccf221a9c59953fcd3a3dd0
  • SSDEEP 12288:9RZeGAfqNGA3Uq29XIDixjpyq0BMen8n45Rv3//Lgh2ha6F:9RSfrAEH9XIYpj0BMey45RvrghYaW
  • TLSH
    T141D49F99D7E445B9E0A2A674C9438573E7B27C0B8371EA9F43B07D622F33194CA39721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojanexecutionpersistence

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2