Extracted

• • Target
    2026-08-18_3297d813279da4e199c2beb3a4a40500_amadey_cobalt-strike_glassworm_icedid_manuscrypt_ryuk_satacom_stealc_vidar_xworm
  • Size 595KB
  • SHA256 495dcd5dc442f06cb21cf4f5961161e6029497f040173e0498db76410d30b6ff
  • MD5 3297d813279da4e199c2beb3a4a40500
  • SHA1 8df301a8d76a842903417f1eef8329eee179deac
  • SHA512 0bcdfdc733e151eb24d3142002c3265c8ff82c47cc7129e5029f9a2bb494e9bdf4a31ca8ff4517739383158db3462791dffcddbf24e6f6159552995da5156d0b
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkeEbQgqLsB+7I2:6yvgUld7LsBK1
  • TLSH
    T166D44B12B7F809BDF4F39A308C714A16DA3ABC665F31EAAF1684015D1E32A909D35737
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2