Extracted

• • Target
    2026-08-17_f0ea023611cc632ef5ea49b8cfb5a338_amadey_cobalt-strike_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 7.2MB
  • SHA256 d98d236918377663518521ed8283cd97dc9bdbbdac4b0e40d0a3f7b7e19c1c8b
  • MD5 f0ea023611cc632ef5ea49b8cfb5a338
  • SHA1 305c4908f7b8d9a19e455dac0e4099b8ddce1692
  • SHA512 6958ed26be2d60d725130fc59394e18f5889122183c8f71ea7e1440b59d8ae3a7aed8bd6a725d5e803eabb8c2df8fb092266d2a857c39398ecb65960ac8d3feb
  • SSDEEP 98304:aIo/pWM1DHZ62w5HKjJRhIHVruP3WpF3UdE1hZHEdkFK:auaRhgJuP32+dmhZkaK
  • TLSH
    T1A076AF2E7AD20036CD5311769E5F9104E338E0076315CAE77BDC83985FB1AE29676BE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2