Extracted

• • Target
    2026-10-25_70eb27c8eb9d576b306fc52c48b9135c_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_smoke-loader_stealc_vidar_xworm
  • Size 602KB
  • SHA256 912f771c59949fa5bff0dd82b0458e7aeed31af68bc65dbff7eb5330fbf327c0
  • MD5 70eb27c8eb9d576b306fc52c48b9135c
  • SHA1 6fb5d35a9bb24dced0fb16d5c8cdbb8d41ee1346
  • SHA512 76fa03f6bca969b05f4c49b9dfd34e2aedabf0126960d7d51c0151578ae7149b2c1f72d1d0ec0a15408070dcf83521db7c6a45808390ace227b70728e613ac3b
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/e/msumGlcZG7X+xErtP5iW9JuZIsJFKRx+b2o:6yvgqGmG7uaB5ibFKRxe
  • TLSH
    T1FDD49E15F7E404F5D4A685748AE186629A39BCA60B31DEEF17C8072D1F337E08D3AB25
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence
  behavioral1behavioral2