Extracted

• • Target
    2026-08-14_930681fc22192996879560fa2a72d9f6_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 545KB
  • SHA256 3512fc146581283587a567c331aadf23fcfa1406ea4b6fa37bd5cefcfc06c5fd
  • MD5 930681fc22192996879560fa2a72d9f6
  • SHA1 64e943840baba53427dafb3b935abf37d8b14fd0
  • SHA512 4a86b389cb824eee76ba4fa6ddcba57b3c26ad1f2ad1f92e39111520e3d47a9e168adf068c8fbf629350a7f4cb0b376fa257ba77661b58f0524c493f1b4b7eb1
  • SSDEEP 12288:jYyDi5rNipDuysMFZzN/E/msumG7sqbhb5sQlzH8xE1NySoGX:EyggUGXbhCQlzH8xE1NySvX
  • TLSH
    T1CFC49D06F79404F9E5A7C174C9A24546EB35789B0B71EAEF0798436A6F337E04E3AB10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2