Extracted

• • Target
    2026-04-16_3668f784b4e27e5af8dc696dbe757dec_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_wannacry_xworm
  • Size 397KB
  • SHA256 6e2674dce4d402474e52dcfabb64961aafb4b65f93218572dcf75f99aec04970
  • MD5 3668f784b4e27e5af8dc696dbe757dec
  • SHA1 7694e111195b2a85dfb1e88595c8018aa6c81f84
  • SHA512 c1d4a86ed1a2c6b43bdc543a3c79fd593b0294926dfa7d92f17a6d097f41a58e2e2fb295d694787bc3b76d7cf01ba792b9f694833fd2181de005a6cafc040e58
  • SSDEEP 6144:p+GYnA0zeWsDi5rJziQ8kd3f+RysMFZzN/E/msHOtbMriqNsarwm:pYyDi5rNiQDuysMFZzN/E/msumG7sb
  • TLSH
    T127848C06F79408FDD59BC57489A34656DA35B88B0B72EADF17C8422A2F337E08E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2