Extracted

• • Target
    2026-08-11_bd271b8f097f9210a47d9fc831726d6b_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 562KB
  • SHA256 c7737262995bb921fc1e37523491fe32c1c67fa03d425799c1567047da1d4265
  • MD5 bd271b8f097f9210a47d9fc831726d6b
  • SHA1 12b5e04cf358549bb7dc3a02ee6035d10e5e43eb
  • SHA512 fd7f2f648f172a3edc52547e05b6208e371ba8c9c1faa5f5ee0085dd039b4235edf3ca37da28ca0a0649be617d32bc8dec7d6d804394ef8052d00f80499212be
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkejBHNp0fc7:6yvgUlrBAfc7
  • TLSH
    T101C44906B7880FB8D56F8174C9924596DB377C4A4F219BDF07946E2A3E326E08E39713
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistencerattrojanprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2