Extracted

• • Target
    2026-04-16_8d027de0586fc8941825ad53f29d335d_amadey_cobalt-strike_glassworm_hellokitty_hijackloader_icedid_luca-stealer_njrat_ryuk_satacom_smoke-loader_stealc_vidar_xworm
  • Size 1.7MB
  • SHA256 b2f8ea052d4a0c04f6a2893e9b40434f42d322ae4c93179a8a6910f9ed9e36aa
  • MD5 8d027de0586fc8941825ad53f29d335d
  • SHA1 386338fc6d8be2899b083d536b1565d37dd2498b
  • SHA512 597e3e2c07f2562fcf5301f3c226eb6e2dd5aa798ed21c0baf0d61ee3fab237cd6402ec10dda1eb0934a9cf41058088443ee622eb8a298447e382af1c206909e
  • SSDEEP 24576:6ydgsGMw8KH/B1FBgDXZNFfZoWe0KVIC9ClKa5IrykTHhQ5NoRyftZZriXWzr6ph:iKK51rgXteP3Vz9oI2mhoNosVDP+fXZ
  • TLSH
    T13E850205FB9004F8E4FB893489A586529A3DFC9A0B71EBDF17C447291F32AE08E39755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence
  behavioral1behavioral2