Extracted

• • Target
    2026-05-29_55edca4fd61f44b04c09f827476bbb56_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 563KB
  • SHA256 614ca0f84a05928325d6c6721d0067cb96c2424e5ddb0169e31095dbfa5c890d
  • MD5 55edca4fd61f44b04c09f827476bbb56
  • SHA1 b28f04f3f9e6d6e71f2e07ee5088e9783dfec265
  • SHA512 416bc4f00cf4d2414b806f1cd40e32b02e17412f4a5a014e0b300e7f04bf44204e04340ef5bf69f66628cd1e723f58701e8ffb577c167fe6367bf0d58eecd988
  • SSDEEP 12288:jYyDi5rNiQ7uysMFZzN/E/msumGlcoSF3HAbU0oWeGJ:EyvgUGXSdHA40DeGJ
  • TLSH
    T1B6C49E16F79404FDE5A7C174C9924546EB36789A0B71EAEF0398432A5F337E08E39B60
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2