Extracted

• • Target
    2026-08-17_3c920ed7aee207a765edf0b490f45a61_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 736KB
  • SHA256 832fadf0cec077fcaa1e35b347ecc7579358df47cb8361697c0aab98616f24b0
  • MD5 3c920ed7aee207a765edf0b490f45a61
  • SHA1 c445c38c069bc917c589049330d0196ac52a2e3a
  • SHA512 956ef63f90126ee02d99073a571cb12b962bf9881fd1f4f70eb503292812640429617295a30b17a483b4e6e9d0d08a5fe97da152bf927bf5e93406f17a0b990a
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlke6+E9UuFuUGx+zR5JeKsghPBOqwh5:6yvgUlypjk+hexgAjh5
  • TLSH
    T1A5F48C01F7808FB5E5AF4535896686A59A3F7C654F209BDF13882E2A7F316D08E34723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2