Extracted

• • Target
    2026-08-18_547a035a888ca24d43614f5df7fee8db_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 2.0MB
  • SHA256 7c51a3864b3f7d18472cc80a42b742d24aa4e7d96219b5295a49b5b5f7d971c1
  • MD5 547a035a888ca24d43614f5df7fee8db
  • SHA1 0ef09c5b44495bb57fdb11be1e0473af1ad63082
  • SHA512 2812079fdb697c44a9f33713b9a2fc4badb160a5c2bd0c5a22b284ec5f6ee13269ca4bf938bceaf6eb7abb40b0275bd88a483facf75571cdb8f0219614c47d33
  • SSDEEP 24576:EyvgUlxRHcCdOYtaZR9/uwZM49HkA8N/JYiToIlO70o3:qqR84taZfRZM4dRw/tTM1
  • TLSH
    T18DA58C07F65544E9C05AC178CB46C632EA71BC8A0B75A9EF13906B163E76BE01F3E721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2