Extracted

• • Target
    2026-10-28_8ab8b12d94257e9b9fc4781405ddc3fc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc_vidar_xworm
  • Size 4.5MB
  • SHA256 d71718d868051ee973dcf0e2a214d2b7ec08fd3bb9b490d1e1b1ec22ddeb2918
  • MD5 8ab8b12d94257e9b9fc4781405ddc3fc
  • SHA1 56ac1ad80bc31c7b0a29d6a9a2836ad1a9247201
  • SHA512 eec644d52ce45bbcc9d123b3d74e49e35961906451f153d6e5555ea2d12796f1674f26d6cb7cabaa85b58d058356e0ee10808bc708dadf2ed2c76c010989e016
  • SSDEEP 49152:PTQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:bQvGAdlCEL8c/bRNw5CO
  • TLSH
    T15C266C65ABF880F5E0A7D178C97A86B2F77678420D31EB4F0291C66F2F336904D29725
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2