Extracted

• • Target
    2026-08-15_2379cc97a9b46ce554a5bb29b2e0d269_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom_stealc_vidar_xworm
  • Size 687KB
  • SHA256 4d16a8f0461315b577254d907530de0f4005478c8d75b90275dbacb8caf2e583
  • MD5 2379cc97a9b46ce554a5bb29b2e0d269
  • SHA1 a6a2bd881d0a47d727fb8366ec2ae51688d7ffd9
  • SHA512 6eaa5012d2324975aef2e9636f42cc1297e5b1d63eb1ecaa71f047e855324752e7a786da91bfae0fe41b541ec95184b7def4a92e590224d4ca8ba022da952a47
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkeq/TUALF0QstO/+9EiFb4gexJAdGyC:6yvgUlS/zgOW9EcaxJ+RC
  • TLSH
    T162E4BF12F7904CF4E467953489E686628E39FC9A0B31EADF13D8432A1F327E05E39765
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistencerattrojanprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2