Extracted

• • Target
    2026-04-24_b6874cb69489ada27bbb5a33dcb0f807_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 974KB
  • SHA256 876dadd432fc5aac9eb03852f4374e4863648c9e52d847e10f59f44f68c9779a
  • MD5 b6874cb69489ada27bbb5a33dcb0f807
  • SHA1 4b784bc189fd0c14d5dde4afcd1ed99a7a08de2d
  • SHA512 9bfb2f2e2f25dc626b4c4696cf0923f39c52342d29ac127257464edd07d617e6b49c3c7b0e2547cb42336d6d4779a044ca6f4e03e0b3936ca5c010776fc8c66b
  • SSDEEP 12288:jYyDi5rNiQDuysMFZzN/E/msumG7s0YyDi5rNiQDuysMFZzN/E/msumG7s6AsG6:Ey3gUGiy3gUGzl
  • TLSH
    T166257D01FB4404FED867C630C5A156568E3ABCCA5B71EFEF12982A292E627E08D35774
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2