Extracted

• • Target
    2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 1.2MB
  • SHA256 56b2e827a8553d0ef48555984de1326e3de466a30d50ef7f8ca833fb28ef1567
  • MD5 091bce8fdb606938b0135ccc2f279b33
  • SHA1 4d34d352faf7ad606b57b3b2e2e03f95470aeeb9
  • SHA512 6d01267188b654a4e393d2ce6ddb6025ff17f2b92a1c08d6f957755225698fc5efd15a68e86e80200fe8f8c35a3d2c253d59d4c9814bbbbaec6415b62b01f874
  • SSDEEP 24576:jvRAx6rOrM8gkpyxi6FwZa7afvFFFLChKMdDBbPjXbz:HOrXT6Ca4FFFOhKMdDBXr
  • TLSH
    T17B555BC3B29401E4C8AB97305853463ADBB37C2A47A087DB1A54765E3F3A6D51F3A723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojandefense_evasion

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2