Extracted

• • Target
    2026-08-18_81504a5634d90225955c0f7d42a1ea8d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 4.5MB
  • SHA256 b133e8725f59e663f8dfee580524440172500ad95b37dbf3d363df5bde61efdb
  • MD5 81504a5634d90225955c0f7d42a1ea8d
  • SHA1 9935dba78c189cb0d0fbe211f3247ffe49017201
  • SHA512 5c0d0e68f24ba6df3bff37ee86cfd59edbfad8438f30eaa5c6e1a669decf06f2d4392a5b715f60e16d672c56c8e2cc489e065b9c1ed0cb758bac03b3f2194e89
  • SSDEEP 49152:0EdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTY:G/IJsiC5sop7cTY
  • TLSH
    T18A265C656BF880F5E0A7D134897AC9B2F77678420D71EB5F0291CA1F2F33A904D29726
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2