Extracted

• • Target
    2026-08-13_b0302d32eb2c4fbfff0a2831dccd1817_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 377KB
  • SHA256 3c39bacdc109466d5d068de4909eb7a3c51a0f8f2c06a20f855033978e533149
  • MD5 b0302d32eb2c4fbfff0a2831dccd1817
  • SHA1 de44a1a1c517a879f2d265ea53a24181fb1790dc
  • SHA512 adb4048d15cc5a15a7d339cdf36a16899c2b6ddc806c5cba82446eea95f0738f54638b8f1fa16b0b6149c5d8991946aa14f00bfa4d255392fcaac54132b1989a
  • SSDEEP 6144:p+GYnA0zeWsDi5rJziQ8kV3f+RysMFZzN/E/msHOtbMrJW8sIrw:pYyDi5rNiQ7uysMFZzN/E/msumlke
  • TLSH
    T182848C16F79408FDD49BC57489924546DA3A7C8B0F72EAEF17C8422A2F237E08E39751
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2