Extracted

• • Target
    2026-06-02_7c50c69d55dc3a343d4ed615f85ad383_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 399KB
  • SHA256 711222007c1ce1626620c5210ca59638d968acadbb4d95828154ea782d3144a7
  • MD5 7c50c69d55dc3a343d4ed615f85ad383
  • SHA1 62e8f04b605f9575378b1cf0975f3a3944f731ea
  • SHA512 2ea2e07046ec899f871dd8ddc853202a08561f5e47ea982f943009b0f9e8cb696f5fa2ebc70db1287b26a4e3cea1dd5ab2a61eb33bd0862cc0923a3c9ba1cb87
  • SSDEEP 6144:j+GYnA0zeWsDi5rJzip8kd3f+RysMFZzN/E/msHOtbMriqNsarw1+K:jYyDi5rNipDuysMFZzN/E/msumG7sU
  • TLSH
    T1C7947B16F74408FDD99BC5B489970556DA39B88E1B71EEEF07C8422A2F22BF04E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2