Extracted

• • Target
    2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom_stealc_vidar_xworm
  • Size 12.4MB
  • SHA256 14c71a9c11b531857e15b713a9895989ba7a57a754e2c4c5901721843c79c185
  • MD5 ad2457d4f3f80bf242446036abdd4881
  • SHA1 e78968bdd73cd86f95c709e5bba6a3f61da31db4
  • SHA512 0898d9c5496defaa6655c8ea93067a7be77aadf59a8f11c6e021078dcf15adfb0393f60733f12aef9e3cdba4749ffc1a91207783cd9b0311a10dd8994081fde2
  • SSDEEP 98304:EnmQKRICbaWUV+m1oW5lVFwAuHTVk1hZxhu:945EH5GhY
  • TLSH
    T13AD69D0DBBE51032C56721799B9F6101F736C00BA219C99A799CC7D81FA4A7142BBFF8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2