Extracted

• • Target
    2026-08-11_0dde105ab92458853077be4fab699b1a_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 937KB
  • SHA256 fb20ce68387e3270cc5e89b9188305bb8b9f601e312f4de0b3e0a010d3b781ac
  • MD5 0dde105ab92458853077be4fab699b1a
  • SHA1 3ce3d5885d74891aca70bff721e89a31fef03096
  • SHA512 78b829bcf60d28b4385946102e16e7ca3c51f084f7cd2ef218f35f5fa18ae000f3a600004336cc1bf3c1f9bf43974d4b0668c13a5116f96d64ba00b1cc6705d4
  • SSDEEP 24576:6yvgUl8id1ohy6EqNi/Sc7KBwpemIwpeAj:0qdGhy6EqNZcBpeapeAj
  • TLSH
    T1C115AE03F74625FDD49BC5B48A524123EA327C890721B9DF1BA46A263F22BE05F3D719
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2