Extracted

• • Target
    2026-04-15_cf24e932c5c2e6581ab00d98f76f2d5c_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 376KB
  • SHA256 fc7eb1946438843d5b5a382c1d5a1af2e729dcb0e8cda6aaceacb5452c979e96
  • MD5 cf24e932c5c2e6581ab00d98f76f2d5c
  • SHA1 837b763e2678057fbeff20034feb66aa0b02d31e
  • SHA512 1c258f2aa33508363675d125c9cb619fe00d26c2176feb7bfe7988c51bd492d60dabdc624650bc8e83ccce1b58f3dd46481cc5cbb3d5b9fa936ae26cf8463818
  • SSDEEP 6144:N+GYnA0zeWsDi5rJziQ8kd3f+RysMFZzN/E/msHOtbMriqNsarw6:dYyDi5rNiQDuysMFZzN/E/msumG7s7
  • TLSH
    T119848C16F75408FDD49BC57489924646DA39B88F1B72EAEF17C8422A2F237F08E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2