Extracted

• • Target
    2026-08-11_83fc2f7286791350e128752218bddd11_amadey_cobalt-strike_glassworm_icedid_remcos_ryuk_satacom_stealc_vidar_xworm
  • Size 529KB
  • SHA256 4273b3735ca9dc05b689b6b4864e2d43b3cd852f8886e8e42d04622001333431
  • MD5 83fc2f7286791350e128752218bddd11
  • SHA1 187bb457486d3998ee6fc95535b3024c93cafb9a
  • SHA512 308742c3ac9548fe592d6e771cf1c21fe593aeaeb4d6e95285f6c36e7a4b09440330e2dc4020d846f6e073715449b9f2bb7501c318a9d9934d6ebe4c24efdb47
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlketCiB+FqI:6yvgUllCiB/I
  • TLSH
    T1E7B47D12F7E404BDF4B78634897246569A39BC674B31EAEF07C442191F32AE08E35B76
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2