Extracted

• • Target
    2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
  • Size 36.0MB
  • SHA256 3bc4f0923e2c5636126dc1beebcb056b6b6a22d4d350a3f86f7a4f9855d34039
  • MD5 a49be2131917614e5348df5b3169101f
  • SHA1 69eadaa9df005314afbc52dd31ad96df67e483d5
  • SHA512 a5c474b8e3d7eb34049c8d45fd355af90d344543d9fdf3feb8c052b2e3494668f3d1368d0d46e32f4be94d857a2966e0bc5b093955f38243e5e4dae4d7f8b32a
  • SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfO:fMguj8Q4VfvdqFTrYn
  • TLSH
    T131878B0773E60195E9B7D1388AA64507D773B8638331CBDF329D06152FABAD09A7E720
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1behavioral2