Extracted

• • Target
    2026-08-02_579e5b9ed9a272e93f52e03e73815d88_cloudeye_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 1.6MB
  • SHA256 511449009a1130afdfadf88d1b9b825d69e1498d78afe3e5789c22853f428972
  • MD5 579e5b9ed9a272e93f52e03e73815d88
  • SHA1 7c5cc1809792b875e6d1cf8ff2c44879ec7f4ea4
  • SHA512 38bb89cfbe229353a8af0c3803f18eab82db454e4221f99865df8fc776c715e40fdf7727cad5cbbbf0b7037381fe166555cdf2a4e64eae5033cc206d72592cb4
  • SSDEEP 12288:pYyDi5eNiQ7uysMFZzN/E/msummm1UHTyUjD5xszt9euP+b0SoRUJDJhL95+B7ad:6bvgUmpTjsznhmbLoY0BW1oE1tT450
  • TLSH
    T1BA756D01F7809862D86E893078F5D71B2B35FCC66F61C6BB235AF25C1E72791993831A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2