Extracted

• • Target
    2026-10-11_2294bc9d68c112bf2e6b3194cfee43b1_cobalt-strike_glassworm_hijackloader_icedid_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 2.4MB
  • SHA256 269d0a781f1d4bd90df773bb78c1b4f05c04e79972ff177ca8bfde249d9a069e
  • MD5 2294bc9d68c112bf2e6b3194cfee43b1
  • SHA1 dd1028e27506b42f2b97d495f3f3a88445fd6c6d
  • SHA512 1d0440d7b75239f1c6d7196dd4ccfc8d682b5f5e255ae72bf062b06dece278b7ed25ca05fc070a4456b84e5833a2e0579b0ab82028a2ac0001c9c8844216d6ac
  • SSDEEP 24576:6N3gUGjNF9WLJFWNB3ub8lte7O6lV6gjyLKGecwbRCN3mr5KYd6Ke05cOukEwzj+:ToIlte66lV6Jwbwxmr5fdir
  • TLSH
    T15FC56DB9A5AE04D0D176A0B899671046D3B2BC16573499CF2ED81F092F3FAD49DFA330
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2