Extracted

• • Target
    2026-08-22_30679fb4e8e8a019f41c9d9cf7593d8c_elex_glassworm_hiddentear_njrat_remcos_xworm
  • Size 167KB
  • SHA256 6dccc8cdcbdb10ce63a373270e3f4c7317157d24844edb2ef5e1ee5effa2da19
  • MD5 30679fb4e8e8a019f41c9d9cf7593d8c
  • SHA1 09e76ead79bd2e7fec5406d7e3dbff4a32f3342a
  • SHA512 6bd19754771fd7409cb69b41ee36f22399f1d698b0aba83f5b92164d3d88ee7a3417d46e3ba73517b58bdcf5cb0f189ec3ab83a7349f992129841bebc81b5251
  • SSDEEP 3072:vi737sboIxmZFETkPH39O77nUbCfM+lmsolAIrRuw+mqv9j1MWLQt:vi737sbiZqAME+lDAA
  • TLSH
    T1D5F333E06744C465D8AB9AB99837E6A7A433B25E9C68490D38D1FF0F3D33347402799B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2