Extracted

• • Target
    2026-09-08_3a82e55bf825ad2d785e2c2feea8658a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 7.0MB
  • SHA256 a24a205f2b30cba1797fc4d7c0f60f1474e5b26a76eeb974f0b74250475c6569
  • MD5 3a82e55bf825ad2d785e2c2feea8658a
  • SHA1 fb4b43769ddde6dcf8f4360c00458a9335e0843c
  • SHA512 9566a89b5a6e43d11248d6e2f77475188d1a2c0978606a4e829841b345492c5b87714c1d6f64a7ee7e9a65a622cbcb20ce23d21bf65eda937b8ddd48a5c5d43f
  • SSDEEP 49152:qsozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAsq:Z1MbQ9yDAD7KjjqkusjmqMyE
  • TLSH
    T138766C39ABB4C5E5F9ABD83CA9778672FA7279510833530B89E1C21E6F336524D18331
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2