xworm | 60f7714197fa34053087dcde6cd6403ac87647c5e2a94e046f8d29c83adff4d7

General

Target
2026-07-24_15b061e9e397aae96c5e2ba795e6b577_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 10.6MB
Sample260724-lmrkwaxbpc
SHA256 60f7714197fa34053087dcde6cd6403ac87647c5e2a94e046f8d29c83adff4d7
MD5 15b061e9e397aae96c5e2ba795e6b577
SHA1 0300e644896e3a1a51e5c1f83b50bb35bc3dfb30
SHA512 8d63687c80b397d59b863c158c56e9979c9272b09baa3efa941386c9743256fc2733bceb36da42cf0e731db82e97d663145cee9df4318b0800cc29e347ce7e67
SSDEEP 196608:+v/ZDVlLx7/HuL5IlAHIAoa7Lp1CMPWhkd2HsGXq6hpXFSFE7E:+XLr85BtjjzCkd2HsGXqk7SN
TLSH
T16DB6331C67D504D6E8A6647EA5A3D407E6F3B8410B33C5EF03956A0D2E377A04E3ABB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-24_15b061e9e397aae96c5e2ba795e6b577_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 10.6MB
- SHA256 60f7714197fa34053087dcde6cd6403ac87647c5e2a94e046f8d29c83adff4d7
- MD5 15b061e9e397aae96c5e2ba795e6b577
- SHA1 0300e644896e3a1a51e5c1f83b50bb35bc3dfb30
- SHA512 8d63687c80b397d59b863c158c56e9979c9272b09baa3efa941386c9743256fc2733bceb36da42cf0e731db82e97d663145cee9df4318b0800cc29e347ce7e67
- SSDEEP 196608:+v/ZDVlLx7/HuL5IlAHIAoa7Lp1CMPWhkd2HsGXq6hpXFSFE7E:+XLr85BtjjzCkd2HsGXqk7SN
- TLSH
  T16DB6331C67D504D6E8A6647EA5A3D407E6F3B8410B33C5EF03956A0D2E377A04E3ABB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xworm rat trojan upx execution persistence
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2