Extracted

• • Target
    2026-05-11_2f1d61e47d6eeab74a8a4f9529bfb1dd_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 1.2MB
  • SHA256 948d4d11708b966ec8c1e3922d676cd5d74d50ea7098506ea8191d6a04739ad7
  • MD5 2f1d61e47d6eeab74a8a4f9529bfb1dd
  • SHA1 afdfd789f05e682c393aea37d6b15c2799b88ec4
  • SHA512 24d75cb56fca7f094c09e123dc9121569b81603ce3528b9724d2163367f97b225f609bb1b097ffe30aa4766bb945f400a67c70356a7740263fb21763ab1c71f2
  • SSDEEP 12288:jYyDi50NiQDuysMFZzN/E/msumG7sgtBSVoBlhyA0V4UmOPzPhhbMB40kLk3BU/d:EN3gUGXRz4A0VpLP7D8spWcY/0eat
  • TLSH
    T1F8458D1BF79900FDD06AC179CA565222EA71B8460B71BAEF039182693F777E05F39720
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2