Extracted

• • Target
    2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 24.2MB
  • SHA256 2b655e235a7fada0895ca197a65dcde998e1e33b91c16868b64c759fb904059c
  • MD5 9cf5b3e947d1dba0ca6854ddd0890504
  • SHA1 92b863cb8607837128be50275d91777e078a21d3
  • SHA512 4de9f2e474713fd893f95d84a7e7582c9595a8fb0d8fbae445b26919caec84e69d808a3c738c563ad2bf2992f157d71bb510f6b293cda8943e5e74ee13193a66
  • SSDEEP 786432:nkxEp8FaXRyHwkOSZqSzH7eG7U0ficCKzTnswV:kmXRyHSOT7eG7U05RTns2
  • TLSH
    T18047330497EC00F9E1F3907999F38A42DF73B48F5772A68B078C49651F531A0A9BEB61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondefendnotxwormhacktoolpersistenceprivilege_escalationrattrojanupx

  • Detect Xworm Payload

  • Detects Defendnot

  • Family: Defendnot

    Defendnot is a tool designed to disable Microsoft Defender.

    hacktooldefendnot

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2