Extracted

• • Target
    2026-10-11_a4ada3c1c1c5e6375037f3c55f97c736_cryptbot_icedid_luca-stealer_njrat_remcos_stealc
  • Size 2.6MB
  • SHA256 e270660d595e4ab738210d1b99e4f30ede1068a801600ea0758e09d2664ff509
  • MD5 a4ada3c1c1c5e6375037f3c55f97c736
  • SHA1 aabc85f44c4ad88f06b354fa1851896cf04b52ea
  • SHA512 f6e0329745fda7dd9dbd51d8157a1b473ce9cc4207fc6aba3e08f224581377fb178239b41d2d802d91ecc070d18fc30d2bb96edce7d0acfb831d8edfd2defdf9
  • SSDEEP 49152:/6xcx0RYeAAQrFjEzlKoiSAWt5eCOuTRKMxzH5cbaHfb7OvL1yAY1m2q:/6IInQxjulxipO5NgMEejyD1ykD
  • TLSH
    T1F6D501E5A39444B8E0B39178C8378A53EA33B84D4F74964F1698BE572F33391492BB53
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondefendnotxwormhacktoolpersistenceprivilege_escalationrattrojanupx

  • Detect Xworm Payload

  • Detects Defendnot

  • Family: Defendnot

    Defendnot is a tool designed to disable Microsoft Defender.

    hacktooldefendnot

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2