Extracted

• • Target
    2026-08-07_2f98cdd62573f37c046b70c890a7c8a1_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom_stealc_vidar_xworm
  • Size 28.9MB
  • SHA256 fe0dbb2a101288f4587eacd35c954af9e14c895a73dc95c9d9ced0a92f5993b4
  • MD5 2f98cdd62573f37c046b70c890a7c8a1
  • SHA1 d1dd3eda7b17ce94f59357d5dde2e4af03d4a933
  • SHA512 cbe125064c8a1ef9a6d37ced3be43457ccdbb3b6b2daf882e04a1175c509626346b62ac435ee8fbade89729dc7de77617cd500555e16681c9659fe867895506e
  • SSDEEP 393216:Phtu5tnxmahiTTWe5unX3Csc4cKf7lNEMhr+nC0ztt4z10zn4kFVFqq+sKVE6z4n:PhE5FxdhifnESif7hjq2zjkQqj9Zf4MD
  • TLSH
    T1BD673313F0E540BBD6B20572EA18A5702A3C7E181740CDDBB3D879992E769D36F36B42
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2