Extracted

• • Target
    2026-10-11_26148e59d4a4e2a0330ff403677eea62_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_remcos_ryuk_satacom_smoke-loader_stealc_vidar_xworm
  • Size 964KB
  • SHA256 f2fe2e5193d74e881e3afcabdc45da00afc04f6b61f66305be67364976fcaaa9
  • MD5 26148e59d4a4e2a0330ff403677eea62
  • SHA1 02650c1b5dff1706770ab151b365be13978ecccf
  • SHA512 a8e985d9f8338ae199cadfb4bf7db9c725bc771ec50e1a3bf494ca2fc2206b0c20b646bf4d41d7f7e28c9f2d710a1c0810e164087dc9982bc6d742ca57e08dc0
  • SSDEEP 24576:6yggUXVLlJRK5MfIB6441wesB32cOB8omNZjxy/P:j6fn440xL88ooZ1uP
  • TLSH
    T1D625BF13F6A14079E5B352B08DBA75159ABC7D660732CA9F13C80A1D1E726D0AF3E732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistencerattrojanprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2