Extracted

• • Target
    2026-10-21_9a3f5e15f1d029c11a9a46bc7e5935b2_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_smoke-loader_stealc_tofsee_vidar_xworm
  • Size 522KB
  • SHA256 c6f71819b2678d27fef75c76738d78b8a3fa2d2086d11be36e621297f8f53e85
  • MD5 9a3f5e15f1d029c11a9a46bc7e5935b2
  • SHA1 6bcd2fb85c34ae6787f9053d167e6981ee079d97
  • SHA512 5baa85aae8f25158a8f415944a012debcb80da4b452c4956bddce99898c524f5bec8c123b8fe4f49a07c20172cbc380deae093fe2f79a20679943225c8d480a9
  • SSDEEP 12288:jYyDi5YNiQ7uysMFZzN/E/msu+Gls36bi9I6Vt:EhvgsGiIyt
  • TLSH
    T1D8B4B016F7C454F9D6978134C96691A39A3978AA0B61EECF17C8432A2F337E08F38715
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2