xworm | 0115503906403dc9fa9bf5888fde9fb88b248bcf371bd7bb9b14a188ace196c0

General

Target
2026-04-15_d435e826f2a2a227d6d18017423b0418_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar
Size 3.5MB
Sample260415-2kca6sdw91
SHA256 0115503906403dc9fa9bf5888fde9fb88b248bcf371bd7bb9b14a188ace196c0
MD5 d435e826f2a2a227d6d18017423b0418
SHA1 63725c59ee515a91a2eb4f784dddbc35932a461c
SHA512 41c4875eff556a1b628eedee8137618bc130113d0f8c6c9781ed0cb336c71eddf6ccd3bdde6130577c73f28a047076efc878d8cb5346c01cc59f47a6f97cc78f
SSDEEP 12288:iacSyqs+xAUKb2i1NM26gLRh1KKk7rPcr9CBTdPqXPdR/phR9TZkazdiY+qhG2zT:igyqs+k/0qD+qs2xd2YKniPJ9
TLSH
T1A8063CEDA17B50F6C4E65131699102C9DDB43650D26812EB437A0CA13B3FBFEC6ACE64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

158.255.213.175:433

Mutex

OD5wJuKNTLy7qi9e

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  2026-04-15_d435e826f2a2a227d6d18017423b0418_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar
- Size 3.5MB
- SHA256 0115503906403dc9fa9bf5888fde9fb88b248bcf371bd7bb9b14a188ace196c0
- MD5 d435e826f2a2a227d6d18017423b0418
- SHA1 63725c59ee515a91a2eb4f784dddbc35932a461c
- SHA512 41c4875eff556a1b628eedee8137618bc130113d0f8c6c9781ed0cb336c71eddf6ccd3bdde6130577c73f28a047076efc878d8cb5346c01cc59f47a6f97cc78f
- SSDEEP 12288:iacSyqs+xAUKb2i1NM26gLRh1KKk7rPcr9CBTdPqXPdR/phR9TZkazdiY+qhG2zT:igyqs+k/0qD+qs2xd2YKniPJ9
- TLSH
  T1A8063CEDA17B50F6C4E65131699102C9DDB43650D26812EB437A0CA13B3FBFEC6ACE64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Detects Windows executables referencing non-Windows User-Agents
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Suspicious use of NtCreateUserProcessOtherParentProcess

Detects Windows executables referencing non-Windows User-Agents

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2