Extracted

• • Target
    2026-10-25_751c7c221f96717b24c94eba7b5d8e5b_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 480KB
  • SHA256 d28d1803f04b0e9b23a5b53ec4f4276bac5a78f132f12518a4316c74e509ff21
  • MD5 751c7c221f96717b24c94eba7b5d8e5b
  • SHA1 bb5d5311edb509892d1fd44b45134ba4ca434c6d
  • SHA512 9a23a6084292e7c71d321add246d0472212b9b915af73adc733aca7b815dd282051115c485ef84731d3ea2a22b1415a7dd43df9e11bc36f1fbe436437a7c6982
  • SSDEEP 12288:jYyDi5rNiQ7uysMFZzN/e/msumGlch15z4hwUc7:EyvgqGmV4W7
  • TLSH
    T108A49E11FB8048F8E5A7817189964667CA35B8AA1B31EDDF13D8472A1F327F08F39725
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2