Extracted

• • Target
    2026-10-11_7f88a0dc4638894c24e780fb0613d3de_amadey_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 596KB
  • SHA256 fba8545c47d490e3613e5b1490fd3815c8983b7c6c9b83a02ade5608331c969e
  • MD5 7f88a0dc4638894c24e780fb0613d3de
  • SHA1 b01db615386529a916a387aeaafae0f6f4a8c259
  • SHA512 32101ca9e7daa7030567ed772ba4a9b06d1dda54133d04497c9baa0797b1e8e12230af957a04a10e3fc0a124e22a39175a3c9f7a1b3892f53e84ee56f72fc8ee
  • SSDEEP 12288:nyDi5rNipDuysMFZzN/E/msumX7sytbO9ipWLu0I3eB+gRMhIW:nyggUXD+iEoeB1qhR
  • TLSH
    T1AFD43B11B7F809BDF4F79A3089714A26D93BBC669F31EAAF1684015D1E32A908D35733
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2