Extracted

• • Target
    2026-10-22_9cd0f114906ce9e65b505ae283ecb07f_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 377KB
  • SHA256 7f4d74c66aad7e007aa7af5456bf3d18ba09edcd8ff5dbe3fd1c7a13a294207b
  • MD5 9cd0f114906ce9e65b505ae283ecb07f
  • SHA1 295a0a002efed28202bc8e4f7eb745117015378a
  • SHA512 d9380b183fc1bfe8d5d385fdeb90232bd8c81ddf2c954bdfe54d524527b7fd57bacb0fab3b694cfe41b51379c609d3ba0fc9f44329645c06c15984fe7fbc0796
  • SSDEEP 6144:p+GYnA0zeWsDi5YJziQ8kV3f+RysMFZzN/E/msHOtbUriCNearw:pYyDi5YNiQ7uysMFZzN/E/msu+Gls
  • TLSH
    T1F8847C16F75408F9D5ABC57489924646DA39BC8F0B72EADF17C8422A2F337E08E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence
  behavioral1behavioral2