Extracted

• • Target
    2026-09-13_58fdbfdd3f095dedf841fcb992f40eb2_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 377KB
  • SHA256 ef1fdc8ad732c522b7d95b413b1c011f72883e7a1f395ad32804079cff98022c
  • MD5 58fdbfdd3f095dedf841fcb992f40eb2
  • SHA1 8d71ba798360f4c70994057b755be3e54066ac1d
  • SHA512 898fe7536620cdea951a51101ac380f2582e018fd2026420588639edd99ed28cd9b244389238d1dc94fe589224c01b65b0ef51af6be1de2b661695c7961f2b4a
  • SSDEEP 6144:p+GYnA0zeWsDi5rJziQ8kd3f+RysMFZzN/E/msHOtbMriqNsarw:pYyDi5rNiQDuysMFZzN/E/msumG7s
  • TLSH
    T103848C16F75408FDD49BC57489924646DA39B88F1B72EAEF17C8422A2F237F08E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2