Extracted

• • Target
    2026-04-23_8abc90902efcdf40be3405f4eb62540d_amadey_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_smoke-loader_stealc_stop_vidar_xworm
  • Size 822KB
  • SHA256 409aa033ed50a5d25d3ff388e3c75d22a273fb3705eb0037665d5438b5ddd453
  • MD5 8abc90902efcdf40be3405f4eb62540d
  • SHA1 144a48647a21404bfa951b2df1094643b371e094
  • SHA512 2c73207a0dd7312f80c115d673be8a8485ad44cfe3522f54f411b75e88dd9a2f1cff706701c40615bf4663d7e1fa826a971130cc8173db223c12a4a4d9fb8df1
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumGlcrZc0IursYCYQeSnyZJiqlEbXSb9NtCGOF2r:6yvgUGSMYenGJiKEbXWtfOkUG
  • TLSH
    T1C805AD32F79440B6D5A24072D956C121BE3DB44A1F3099EF07C48B2E2F796D1AF7A346
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2