Extracted

• • Target
    2026-11-03_78bad501f6d1493a4cc1e424480aed5e_elex_glassworm_icedid_vidar.exe
  • Size 61.7MB
  • SHA256 8d15b1d33af0a13b21f62e076da34b9087616266a091c67306030d123f946d63
  • MD5 78bad501f6d1493a4cc1e424480aed5e
  • SHA1 64bef9cf65b4cc39efb2dbd462a4f6168007d204
  • SHA512 e3d9accbbc50880e12d3e077b5dd8c6a6f8dedcbc588f2407e1893176b2dcdd91c8e6f16249fbe736725a6aa0eb06622304e305d1c95a60395d1b6bbbc5bba87
  • SSDEEP 786432:pHa3XNRS0JSzZ66hWBQYtd5WdXf6vFCz5BHW54sHJE:Na7SzZtWm7PB254iE
  • TLSH
    T16CE727A13434F66BA7A20777909B06E149EEBB717DB2585183CBC09CCB31267BD8D16C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1