Extracted

• • Target
    2026-10-11_5c6aa8cdfd83df1c8912bd94e39f2852_amadey_blankgrabber_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 18.6MB
  • SHA256 15e8fa4f893e297e6740729bc42324b297628005ebc47691479d32c3c136816b
  • MD5 5c6aa8cdfd83df1c8912bd94e39f2852
  • SHA1 5c847aee984b7a793c19621b0ef23652b2bcd20a
  • SHA512 3af9c86c9c4ba4216361aa1c7d18aab154f18009650a37e5b6e33ad728489b2d177e225b80ae1945d4501a2a20898353a6072a4d2770fa33b81d0927e291239e
  • SSDEEP 393216:UiymbqVcxINazKwdf89nRyE2UV5BpVqYR8Am9RGgfAOFnYIg:jymbqVpNazr8TyE2UVjpG7pH7g
  • TLSH
    T19C173314F761A4B4D1A34330097E83B5D93E79051B66EACF6BE00B3E1E356E14E36BA1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2