Extracted

• • Target
    2026-10-26_c82f87a09efe6f773cd0ce646d921fb5_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 406KB
  • SHA256 87d9f88d6346ecf87e02f0fd5e1a9e59d740ddae665696ed5f26280b25d6e7ae
  • MD5 c82f87a09efe6f773cd0ce646d921fb5
  • SHA1 7f9dcb42b24f1c934c5c97ae5b9e2de66312355f
  • SHA512 eb7365905759e0fc9e691a29d1e049ba2d1e312f4500160dfa786fbe0355f5d0cb906c94494f325b1e757ac6ea65764498032b78e06ed14c110fc0a67ad3a99a
  • SSDEEP 6144:G+GYnA0zeWsDi5eJziQ8kV3f+RysMFZzN/E/msHOtbMriE8sNrwE:qYyDi5eNiQ7uysMFZzN/E/msumGm1d
  • TLSH
    T1A0948C16F75408FDD49BC57489924546DA39BC8B1B72EAEF17C8422A2F23BF08E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2