Extracted

• • Target
    2026-11-07_4a34423b5a49052562aa15980e5ab410_cobalt-strike_elex_glassworm_icedid_njrat_vidar
  • Size 398KB
  • SHA256 13370b305724cbe0e8c5ee3881bc467ab6a7c844fe668dce07b77dd77a9679fd
  • MD5 4a34423b5a49052562aa15980e5ab410
  • SHA1 6504205fd0017208cad534179229c413e284a51f
  • SHA512 4b631de0e32cd9d9924dc84747933d29d9024afa03c8aaa023c30a1302c931e6bb8fcf9dace0181d522fb7efb0b1e7731217e23c761e949afd01d8f7582f7c82
  • SSDEEP 12288:RXvMSZ9lrCbf5wj/5/gVziHlBrCbYR8j:V9lrCbe9XbQ
  • TLSH
    T1AB844A6BF5804A91DA640130C8DBAB20A3F1BDF71731E39B2B8426693E533E35D19BD5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionnjratxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2