Extracted

• • Target
    2026-10-21_a208ce817cc6fe033756d3271bb88419_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_smoke-loader_stealc_tofsee_vidar_xworm
  • Size 565KB
  • SHA256 22d50b444132822f41e52bcf66443aa2aa26b64dad46463ec7cd6165c8d63279
  • MD5 a208ce817cc6fe033756d3271bb88419
  • SHA1 2d50c7232fd785565f04912e0895b64c88695eae
  • SHA512 4fc04edd87c20c5412ffefc24c375cc2d4d2a4cc5610ed3c1ef7a91842dd10a98601c3951f710dd8499c9ba78b2596cda956af4aef2f3a6430a9267088ac6356
  • SSDEEP 12288:pYyDi5YNiQ7uysMFZzN/E/msu+GlsF8A26NdsvKdlg8Cl6oTtvkZw:6hvgsGbd6BdrClvTeZw
  • TLSH
    T112C4BE11F38044F9D5AB807489A68A529E3A7CAF0B71E9DF17DC622A1F337E04E38755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence
  behavioral1behavioral2