Extracted

• • Target
    2026-05-19_8855959392e40c7871984c1e0871de89_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_stealc_vidar_xworm
  • Size 580KB
  • SHA256 6810fd68ced282ed72197433ac548d2297ec0f6cc7f36e8d032ecbaade1de62c
  • MD5 8855959392e40c7871984c1e0871de89
  • SHA1 66a44a84e62139009af7fc3aadb0c65c43cf1239
  • SHA512 c53527ee603ace262f57ff94d5aad6f4365fb3271416aee25abb8b82b25ca54a3221aae5dacee84b394273299134a5d96eecbfabc08819cd4af75493780f4562
  • SSDEEP 12288:pYyDi5rNipDuysMFZzN/E/msumX7sgo9+T:6yggUXk+T
  • TLSH
    T191C45C06FB5044B9D49689704652965E9B257C4ACB239EDF22C45EDEFFF2AE04E38330
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2