Extracted

• • Target
    2026-08-05_69a5cabf08dcf302904cefd848e763e1_dcrat_elex_glassworm_manuscrypt_redline-stealer_rhadamanthys_stop_vidar
  • Size 14.3MB
  • SHA256 b2026a708d2b292afc136557c488690729c90361fd8f8733012eb1c727ba4a4a
  • MD5 69a5cabf08dcf302904cefd848e763e1
  • SHA1 6897f830b373109e3e456d58051c0f35e92916d0
  • SHA512 37557069c03c7b859b9387fd2456ff5c36e986ed0d25a18e2ac571786bebeb0e45e8167b65142de734cc519e06fe9f7ce34b978303b3072219a054556628b74a
  • SSDEEP 196608:9w5pAdXt4SmtF8fwD93xoU57WbN1flPfUsGMdrw/f+yOZY+Tx2iD2peT18rCt0jY:sCdXyhr95gTjGMZwO3ZQiKpoe42LXc
  • TLSH
    T10BE6334FFAE5CB63D5281C7AC8BB817442A1AD05EC35A38A37ED7CF639B63498500476
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionxwormpersistencephishingprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Drops file in Drivers directory

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2