Extracted

• • Target
    2026-07-06_6837db43928a00cb6b18521e0c07dce4_akira_glassworm_njrat_xworm
  • Size 1.2MB
  • SHA256 ea82a27ab45a6533602eac4825e0d055c615938ad2c22ffc657d1bb7705d203b
  • MD5 6837db43928a00cb6b18521e0c07dce4
  • SHA1 4c74c4aa066992e692d3278a5da55e4f03af1dcc
  • SHA512 d457cca0ef86f8c31dc30bf60fe47d835509afdeb013a6821d0cd927fae845f559c053dd80c255b74d3fa1fd36bfb342458a57eeb1f1157fa1bd10a4a7b4af14
  • SSDEEP 24576:1jdygjVC7OHv71h2AVauxNQ8TDm53el6ra:1Zx5C7OHv71h2A5bQ8TDm53el6ra
  • TLSH
    T179456B63B5425CA9D227D17982B792BB713572883332EFB70959AD342F86FC90F4530A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables using Telegram Chat Bot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2