Extracted

• • Target
    2026-04-19_8822b344f2a3c7330677127c7cb2ee75_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 399KB
  • SHA256 cc6cac1ab85569d5ac5ac7200c3c0c2af9097998896198e4dc4de60e28f2d9e4
  • MD5 8822b344f2a3c7330677127c7cb2ee75
  • SHA1 67a967948af53dc429519a61f4af9302ca3586c5
  • SHA512 1400814d18186bb9a89c418ac619fb5a52863907c78ba90af20df5c0ed5b672b053f560a3b7b96261b8e5f6d0a6d05e2909f30be3bc84d108a879f680bf60078
  • SSDEEP 6144:j+GYnA0zeWsDi5rJziQ8kd3f+RysMFZzN/E/msHOtbMriqNsarw1+K:jYyDi5rNiQDuysMFZzN/E/msumG7sU
  • TLSH
    T140947B16F74408FDD99BC5B489970556DA39B88E1B71EEEF07C8422A2F22BF04E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2