Extracted

• • Target
    2026-08-30_f90da06c140f25ae1ca307aa6cf256c1_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 380KB
  • SHA256 b7f88ee826866e219ce1b98bcde26bd091901ca11f4aa41c05a42c307cf6ca06
  • MD5 f90da06c140f25ae1ca307aa6cf256c1
  • SHA1 d3db95e3f141dc43115e51cf27c953b7c14ec2c8
  • SHA512 3ae31743c2adbb591676693dd30b63120fc299140decd0f456a273fa853acbed58f177105c2a34f5d07be2923de46b6be255c7dd1d3ba5a48dbf9a469089a1af
  • SSDEEP 6144:j+GYnA0zeWsDi5rJziQ8kV3f+RysMFZzN/E/msHOtbMriCNeqrwx:jYyDi5rNiQ7uysMFZzN/E/msumGlc4
  • TLSH
    T1C1848D16F75408F8D99BC17489924556DA39BCCE0B72EADF17D8422A2F237F08E39B50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2