xworm | 9067160f19682d1dc2cd7eddba1ce8084e26e646c9aad81509547efa15428ea2

General

Target
2026-04-21_d00742ce4990ff82681b5c44c0eef010_conti
Size 52KB
Sample260421-rs5btabv8x
SHA256 9067160f19682d1dc2cd7eddba1ce8084e26e646c9aad81509547efa15428ea2
MD5 d00742ce4990ff82681b5c44c0eef010
SHA1 5e46def7d08c374cd7dd74ceefa90f0591fcafbd
SHA512 65f744b7b05d6aa40ab6944160bef2287494891477c68b688051178ede7641b25687e05eae3f716203339c41d1f2ccaef84b8b2b8397f82fb111c4bc9520becc
SSDEEP 1536:puHNmqj2+fvzTTDPW4VJkIaiGbFrwOuR/daLzW:pMMqjrT/drVn4WR4Lq
TLSH
T129339F66A652B0D7C15CF07364950772EE16EF902D10AFBE1924C8EE6CD2CEB6C3914B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

zippo01.hopto.org:7000

Mutex

jpwLheSkxdeY7p4Z

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Targets

- Target
  2026-04-21_d00742ce4990ff82681b5c44c0eef010_conti
- Size 52KB
- SHA256 9067160f19682d1dc2cd7eddba1ce8084e26e646c9aad81509547efa15428ea2
- MD5 d00742ce4990ff82681b5c44c0eef010
- SHA1 5e46def7d08c374cd7dd74ceefa90f0591fcafbd
- SHA512 65f744b7b05d6aa40ab6944160bef2287494891477c68b688051178ede7641b25687e05eae3f716203339c41d1f2ccaef84b8b2b8397f82fb111c4bc9520becc
- SSDEEP 1536:puHNmqj2+fvzTTDPW4VJkIaiGbFrwOuR/daLzW:pMMqjrT/drVn4WR4Lq
- TLSH
  T129339F66A652B0D7C15CF07364950772EE16EF902D10AFBE1924C8EE6CD2CEB6C3914B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Checks computer location settings

Drops startup file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2