Overview

overview

10

Static

static

5

2026-04-06...er.exe

windows10-2004-x64

10

2026-04-06...er.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-04-06_b4f10cb321aa4f2f29600f3d208492b8_agent-tesla_elex_icedid_njrat_xloader
  • Size 1.1MB
  • Sample260406-ngsxvsbw7v
  • SHA256 0d526ff36bdec49d3b820bb2e75b3cdf85271d8321c6c784d42748ffb82dbb7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xwormdiscoveryrattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 173.205.83.196:3210

Mutex

  • jJqPmV7YRG8bldRA

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Targets

    • Target
      2026-04-06_b4f10cb321aa4f2f29600f3d208492b8_agent-tesla_elex_icedid_njrat_xloader
    • Size 1.1MB
    • SHA256 0d526ff36bdec49d3b820bb2e75b3cdf85271d8321c6c784d42748ffb82dbb7b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryxwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    • Custom signature

      Detects Windows executables referencing non-Windows User-Agents

    • Drops startup file

    • Executes dropped EXE

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks