Extracted

• • Target
    2026-08-25_c314f5d3ae2b2a62fc5daf55faecc7aa_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 752KB
  • SHA256 116099869c80fa99007aff9c8f0b10aea729630e9e8f3bc2d12f8a9a2db76810
  • MD5 c314f5d3ae2b2a62fc5daf55faecc7aa
  • SHA1 16b7dadf323f49290e0ae98538826be71fb53d85
  • SHA512 3809c1474a779f242bc7ba67c00072837f430385ef6954f6d70edd0e4761014ad210533f4dc9869fd4c288f69588c593cca9b511e6745e47b4c8f85680ef1736
  • SSDEEP 12288:jYyDi5eJQ7uysMFZzN/E/msumBt1/YyDi5eJQ7uysMFZzN/E/msumBt1/:EavgUBcavgUB7
  • TLSH
    T12DF48D16F79408FDD4ABC57489924546DA39BC8E1B71EAEF17C8422A2F237F08E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2