Extracted

Extracted

• • Target
    2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm
  • Size 792KB
  • SHA256 42574c7d99f01e2f6135c83b41b5477214234bd3174f4a2691a87617e7d55bb0
  • MD5 bdda197876b05a1ba7fec469b57338d3
  • SHA1 81a0fa978378fa1e5eea9ba44f00f69a35cb7465
  • SHA512 92191b5044df520a8a6c666840091d29ccb5f2f0c81a5adf9c26a11a994a1c8b04adf42958fbfc851451060e64b793eb7ced8ab784f2305642d58b6435978303
  • SSDEEP 12288:ThRAIazF9QrvPXc8tQ7ARygV0kBjp/5/gVziHlBrCbYn8L:TZazy5Wunq+Xb6
  • TLSH
    T1C8058D6EF5BDB19BEC6E49728C131B12A7FBF4E40713E6BBAD4125042E522D00CA765C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2