Extracted

• • Target
    2026-08-21_5269509b182137827c1312cad5956f0f_elex_glassworm_hiddentear_njrat_remcos_xworm
  • Size 164KB
  • SHA256 4cd6fa183f27da7fd66ed7ea4a201e18048d514c90a792aca862e4b7d0c5aa21
  • MD5 5269509b182137827c1312cad5956f0f
  • SHA1 3179ff161a97b56987d6650b2fe69f54e751c403
  • SHA512 4b980892741fc8d6cdc024aef0d8c77949278d1fab41c3fb6ae6f1b51e2336f46cd6fcec15fc950324db5fb105f64e745a517c6a69b3b36277bbcda52a80b15c
  • SSDEEP 3072:+hULW6X/vTkb6/y3azm8KOh/XM+lmsolAIrRuw+mqv9j1MWLQt:+hU63boMY8+lDAA
  • TLSH
    T14BF322E06740C465D8AB9AB98837A6A3A433B65EDC68490D3CD1FF0B3D73347442799B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2