Extracted

• • Target
    2026-09-22_85c87718f624d8c3ece9d424d30284a6_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 3.5MB
  • SHA256 f5b9822ab2587e51019580a46fd98a6ccf55b0ec4654f5a5481fdbee8edab6d6
  • MD5 85c87718f624d8c3ece9d424d30284a6
  • SHA1 206922be385e570eeee0cca7466b8187d5f28966
  • SHA512 f70ed9b65875cef0dce747ec92b2862d840e581d0dedcd9ff850da0d55ce3a213ca601c4bc00d06b8f63350df62f70c523ee85db7e9d7fc1601038068e6b59c5
  • SSDEEP 98304:C6ID/+E+evxE+qS1IRvSKoDUA6ujLTow+psHPc:C7d2+qyIRGjjLTow+gc
  • TLSH
    T161062209E7F508BDE0B6A1B4CD835912EB727C491771E6DF03A459B75F232A08E39B12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationratspywaretrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2