Extracted

• • Target
    2026-10-10_406d051d3ec1c05a407f91b78ce09702_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 377KB
  • SHA256 52b1871c122e19feb845236d14f60ea564188473407e6d5f42a4fb4c0267fae8
  • MD5 406d051d3ec1c05a407f91b78ce09702
  • SHA1 714ddc292266798ddd3ad5231585d0940613714d
  • SHA512 ee62558cdfbff63c83d48c291f3ead4559b2c68cbea09e3b1bfc4cfbb5eae903eceba53f409b2889bfc4bcd2d6645f4d68b694b25a455d555420a8c1f495f10f
  • SSDEEP 6144:p+GYnA0zeWiDi5rJziQ8kV3f+RysMFZzN/E/msHOtbMri3Ns7rw:pYkDi5rNiQ7uysMFZzN/E/msumG+/
  • TLSH
    T11A848C06FB5408FDD49BC57489924646DA39BC8F1B72EADF17D8422A2F237E08E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2