Extracted

• • Target
    2026-10-11_532d29c674e4340fc9dc593468b1c96e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 7.0MB
  • SHA256 862111eb2e540b73577752432aa2835889bea9f6f19e0e97ec00a2a1196c651e
  • MD5 532d29c674e4340fc9dc593468b1c96e
  • SHA1 35c81dcd649ca010e5da49ea7be6757b62bc70de
  • SHA512 0f7c3846d76f93dd044428f2f5dd6137c5b1965298237188f3c5df83eceec6fcefcc4128a75b10f415e2751e52646ab116be3eb1590d8ff2775f7da04f77eb96
  • SSDEEP 49152:C6ozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAsq:z1MbQ9yDAD7KjjqkusjmqMyE
  • TLSH
    T18A766C39ABB4C1E5F9ABD83CA9778672FA7279510833530B89E1C21E6F336524D18731
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2