Extracted

• • Target
    2026-08-10_9876c5c96cb96b16a159dd2bf6c86dec_elex_glassworm_icedid_luca-stealer_njrat_xworm
  • Size 84.8MB
  • SHA256 20aa185e95a7f9003c8d7bc4718a2cd243020640f4b412bea997b5e653f1f6da
  • MD5 9876c5c96cb96b16a159dd2bf6c86dec
  • SHA1 05ec37fdea6ceb92605590e7c777c857ec2cf9b1
  • SHA512 c39ea57e946c5119b11533d94db05a6185bb9acf189a138b4647d6f1dfa6e12929ec4d7f1f21559c470d13a5072280101339571f01aeb2e8b41cb7b5a318437f
  • SSDEEP 1572864:3TIA7ZHr8r0FzbO1JKGEwZvxs/7fFP5OAofSc/JUNn9PhcOXmmXhnAiZEBTuiAPY:3Zmr0FzeHv6TfrifSc/iF9qOXm/NAQ
  • TLSH
    T1171833059ED17899F4AFC6358DD1DF20E1A7B5AD26838A1A17E00CE02C7B3CAD7F4961
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojanexecution

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2