Extracted

• • Target
    2026-10-22_90932057109ae49ec0dcb967e107010f_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_smoke-loader_stealc_tofsee_vidar_xworm
  • Size 573KB
  • SHA256 6589afc20e80f5b7e89b0a83ac2e71bcdcc7eb2b236bdd4bb045435975eafef3
  • MD5 90932057109ae49ec0dcb967e107010f
  • SHA1 090173df356fda062346cb785350c24d3ec15698
  • SHA512 4a8bdf4616b711161df17a676072d637c2700eba25ab8ec79f91f54d928f0dfb21c97a2a3f5675bf12f191961fa9aa9cc57d5e2a030216344d2792b126c94380
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/e/msumGlckBv3GySq0zzZM5:6yvgqGHBfIq0zzW
  • TLSH
    T10BC4AE12F7D404F9E5E7953089B652529B39BC9A0B31EEDF579842291F727E0CE38322
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence
  behavioral1behavioral2