Extracted

• • Target
    2026-09-07_8c4e4941509a5a40036c40662dc34233_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 382KB
  • SHA256 25a70122508db05bcae0928be4f2c49cd26320d705278b482ae7688f5ccd425a
  • MD5 8c4e4941509a5a40036c40662dc34233
  • SHA1 6ba3df11c717878e9154dd6e65e01f00a7d42e40
  • SHA512 595bdb4008c907bf3b79b7a4499362f565fecb83e1752c9d68fdbc0466af25c53483e04ca0a7dea230baaef515b8ee891cd784bd3f123b3a0cd9a0c9bf08e4f0
  • SSDEEP 6144:j+GYnA0zeWsDi5rJzip8kd3f+RysMFZzN/E/msHOtbMrbqNsarwh:jYyDi5rNipDuysMFZzN/E/msumX7sk
  • TLSH
    T114849D16FB9408FDD49BC574899346869A397C9F1B72EADF17C8422A1F23BE04E38750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2