Extracted

• • Target
    2026-04-28_559c0e367a616e5ed6bd90b9bc57783a_amadey_cobalt-strike_darkgate_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_stop_vidar
  • Size 2.0MB
  • SHA256 681029c73bdbdcdad386dab6701208a5976db4cc4b27731c6d78adc7854ab18d
  • MD5 559c0e367a616e5ed6bd90b9bc57783a
  • SHA1 161d660869b80d38016dba32e220fd6d415e34c6
  • SHA512 361633c1ae0ccb91cc29fff34ebf42fab13988aa392b0acb02216d0956313cbf04f1c70a10c31da52bccf5e8f1bfe75e940ce3d7fcc3fe28810843bdd95d59d0
  • SSDEEP 24576:VVPpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIZ:Tdx4NZCWOLT4yXGQ6m6K2MtENO
  • TLSH
    T18DA5380267EC0169F1F36B71DAB992649AF77C619A3ACF4E12800D4E1DB3A90D935733
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2