Extracted

• • Target
    2026-05-23_bded141bb2a7a22e8d7bddbd4d4143c2_amadey_cobalt-strike_hellokitty_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc_vidar
  • Size 3.5MB
  • SHA256 20aa6137c159747f50c36bf48dcedab67ad6e38f6bb05437d0d316b37624a62d
  • MD5 bded141bb2a7a22e8d7bddbd4d4143c2
  • SHA1 4340c2f0e6428de02027000c6bf2269b57f809b3
  • SHA512 0248be708f847082e11a78530661f41c62512dd7b6b8c0b3c88123bcf8806a2f625ea20788c71302916ea9c64ce5c0aeaa2fe61f4d914ee6af5e277d51fea30f
  • SSDEEP 49152:Jdxm663XqIl475RXcwviBeHBKFRgF1/F0DX3YHBKFRgF1/F0DX3c:JO6sqmYNdHBeRg7tIXIHBeRg7tIXs
  • TLSH
    T1480612016BEC00BAE2B39B358AF14A929AF77D6687205FCF02D05D0D2D775D1E939326
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2