Extracted

Extracted

• • Target
    2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm
  • Size 5.3MB
  • SHA256 28d78a8495ec4cb28c99572757058c74410c125e823ed9619ec6a7d54e34443d
  • MD5 45077556cb729da6ab48ac4fe44f97ba
  • SHA1 15e58fe8bad90e0a3a757590a6f817549de6b6ab
  • SHA512 780986f039cd9dc2968426e5e96b18a23feb664c4a97f119e3cc489669a4b1b1d32f0ff1cd6e1f45a2e60fce646e75b0eea36576183c8b19e60412a3c08af69c
  • SSDEEP 49152:sssV/ut+pzwwk6Sf5cTXh8hMwSS5MhpCVjiVKr7emKa9z7wjsXCbftLGYVomqw6M:ecklljCVjY/Oz7wP7BGmqLQ9J1oPr09f
  • TLSH
    T15E46BF5AE7A449A9C0B3C0FD45169423EB7238861335E6EB52F0C956EFA76D02E3D370
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralxbinderloaderspywarestealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects binaries and memory artifacts referencing sandbox product IDs

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing possible sandbox analysis VM names

  • Detects executables containing possible sandbox analysis VM usernames

  • Detects executables containing possible sandbox system UUIDs

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2