Extracted

• • Target
    2026-07-08_3e5dabc3813789f65609ddfbd200b706_blankgrabber_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar
  • Size 5.7MB
  • SHA256 949adbf5d39f14181cda60ca9a5b6242ccb802fe860bc211697c7db8ea01c3be
  • MD5 3e5dabc3813789f65609ddfbd200b706
  • SHA1 77386dd8e8b54127d39988e0ef03a671a4400595
  • SHA512 db264dcd0a08b9dbaf63cd3b0d5a8cf97d017ffe59464473de899cc1537df16540837ee4775ed15badff1bc6e63ebd167b08f8ce9688cf5682e23110ec9ca41d
  • SSDEEP 98304:fuQ/Q0mbqokljQ34mPgvzXp/fKD4fnkBgH9Ciscms/jwyIA2c0PxRvv:fuSQ3+oojQ34W0ly0kBgdFLmCbyHv
  • TLSH
    T16B563355B535A1FAD19B2FB884CC0766F2E7FD22071082DB56A0A29F4F327D68E38711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2