Extracted

• • Target
    2026-05-10_91600779b353025f60edfd376ed61716_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 377KB
  • SHA256 a413a7a3c1cda892ca457e4a4846f50ce403b10edccf75c08ff7e264b9595739
  • MD5 91600779b353025f60edfd376ed61716
  • SHA1 b186c0fef21eb9c2bc4374321bc93f5b80145907
  • SHA512 1d6b23247d39456f7c3dc55789de85d7879e2a03aa128e70473830a7055062feacd5e94c68a39521aa14cd3be71952940a67dbcc092243027b33e7ec2ce740af
  • SSDEEP 6144:p+GYnA0zeWsDi50JziQ8kd3f+RysMFZzN/E/msHOtbMriqNsarw:pYyDi50NiQDuysMFZzN/E/msumG7s
  • TLSH
    T14F848C16F75408FDD59BC57489924546DA39B88F0B72EEDF17C8422A2F237E08E39760
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2