Extracted

• • Target
    2026-10-25_cb17a6d38198124f6a1f48b3ae223a0d_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 417KB
  • SHA256 693360327b9ea977b588c92ed02c906bda83d85c6f6a2bc2eb0e59d15914a047
  • MD5 cb17a6d38198124f6a1f48b3ae223a0d
  • SHA1 d603a9ce82795dfa7e16703ef5d92fbef7970696
  • SHA512 2b313c72c6204a4e4a3ea1c737ecdca83b86a2845ce78919acfbcac161cb990ee4113db53b52f90963fe0e5f16039a1a505f54b07ba6185d0d4582762f0a5c3c
  • SSDEEP 6144:j+GYnA0zeWsDi5YJziQ8kV3f+RysMFZzN/E/msHOtbUriCNearwQwKbgZC:jYyDi5YNiQ7uysMFZzN/E/msu+GlsXF
  • TLSH
    T1E0949D06F79408FDD5ABC57489924656DA39BC8A0B72EADF17C8432A1F337E08E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2