Extracted

• • Target
    2026-08-07_fb79c11112ac02c58474270290730e54_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom_stealc_vidar_xworm
  • Size 28.9MB
  • SHA256 8e202010cccbec9134a3232a4b0e4084d92010351ac819355a1b7a34ff818c05
  • MD5 fb79c11112ac02c58474270290730e54
  • SHA1 06956228c15d1370a06d42f53447de86f741087a
  • SHA512 fde748c5737e23ad954c9a5327d1db5aed0937b957bf6de4e6db8fe8ba99a50af91825c6f1cb0f2e30aaf98543cf5cf1da266fddf6d9da8a5688361e473c464e
  • SSDEEP 393216:shtu5tnxmahiTTWe5unX3Csc4cKf7lNEMhr+nC0ztt4z10zn4kFVFqq+sKVE6z4n:shE5FxdhifnESif7hjq2zjkQqj9Zf4MD
  • TLSH
    T162673313F0E540BBE6B20572EA18A5702A3C7D181740CDDBB3D879992E769D36F36B42
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2