Extracted

Extracted

• • Target
    2026-10-22_09a9573b4565758a3287d01ff2c8f608_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
  • Size 570KB
  • SHA256 03283daa1dfa549358b3cfcea25bfd84ffb6663bfb90ff2825dd1654d97eaa03
  • MD5 09a9573b4565758a3287d01ff2c8f608
  • SHA1 01122422880c62717c49190967d177f09ff988a3
  • SHA512 d0dbdd9138ec4108b6a678bb80dcdbd1adb410a25f5b9469e9e59ebb02f4e8d040760d295b769ad1599e80f263afa0398543c3097e257776ed6352b559ec6377
  • SSDEEP 12288:nCQjgAtAHM+vetZxF5EWry8AJGy0jUe97PVsYFK5BNMHD9EWOHW:n5ZWs+OZVEWry8AFW97PVsa0ByHD9SW
  • TLSH
    T1F0C4AF09E3E809F8E0B7E578D9564902E77A7C4E03719B8F13A4466B2F67390DD3A721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphemedronexwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables using Telegram Chat Bot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2