Extracted

• • Target
    2026-08-16_65875bb6870934472f20de8b3e1c3836_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
  • Size 20.7MB
  • SHA256 38dd7290ba913cfb7a895fe3e0e9901bf08a92da63c95f787b0fa40570a73664
  • MD5 65875bb6870934472f20de8b3e1c3836
  • SHA1 251c04e553768ef9bfdc43eb38c593aa2e790193
  • SHA512 771e9947e620c61178c366c8196d60c03ec7169e3ed40feceebcf5f6260151134f7dde9bdbe052d72d031092540b809974814d24722bc48b795654bab2c21675
  • SSDEEP 393216:tcIUaCuzpLD8rZs6iw8NlDQMT85vz1yMgkpnGCnGjmZMwBWqBJPjF8bfT2hm:8Hud4Zs6iw8NlMN5vz1LgkpnGCnkmZM9
  • TLSH
    T1402733D1A1C40CF7F8974B3A88864C62D796FC621BA1D1CF07649A952E239D1AE3F731
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing URLs to raw contents of a Github gist

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2