Extracted

• • Target
    2026-10-26_5dece6adb9d236d775dd9fcdae1927d0_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm
  • Size 411KB
  • SHA256 7646ff7af3b53ada9744b74909ef9785d108a2df610e0aa72c8324b77d8c8f2e
  • MD5 5dece6adb9d236d775dd9fcdae1927d0
  • SHA1 0f22af81868faab1103bc0eeecbf7f66f02c4012
  • SHA512 a3f8746291b91492d8983b191bb1a16510f69cf96e92c412c8d6ff3e666d86309ac5358d920a6ace551e7d479c6eccfeebbec3978f751d9976333a8e3f57e669
  • SSDEEP 6144:j+GYnA0zeWsDi5rJziQ8kV3f+RysMFZzN/yZ/msHOtbMriCNeqrwXoA2/:jYyDi5rNiQ7uysMFZzN/e/msumGlcN/
  • TLSH
    T130949D06F79408FDD4ABC574C9A24646DA35BC8E1B71EADF1798422A1F337E08E39760
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2