Extracted

• • Target
    2026-08-15_9692fe84e615cec1efc711dd2deb56ec_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 896KB
  • SHA256 271eabfcf42337d9420bdf35882910440c2852de8d2eec24839dc0494f02b077
  • MD5 9692fe84e615cec1efc711dd2deb56ec
  • SHA1 bd5f90f4b7ce8aae0cb8f17444024ca7808a2d01
  • SHA512 6970eda5b8855c2de01f88d52bca1b8ab3f7bafe2769d4840e3d5861eedc72e137db9ecf8ede9ece6d598483c92cd7b00b574117a7f4b0a448332867d2b5c75e
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkeVHTq/zofXyc+MZd0qG5v9KbyEFeaj4Q:6yvgUlo/KCtMZd0qgKWEfV
  • TLSH
    T14D158B16F68100EDD81AC078C7AA9632E936789E1B70B9EF07D4C7551E33BE09B38B55
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2