xworm | 2026-05-30_230473f104c78fd95392877a8b2b5d28_cobalt-strike_elex_glassworm_icedid_xworm

General

Target
2026-05-30_230473f104c78fd95392877a8b2b5d28_cobalt-strike_elex_glassworm_icedid_xworm
Size 375KB
Sample260530-bbganacw2t
SHA256 b978f16b0faf28cfb2e8d7c120a3f6b7ccb73ff71110c99943e1ccb2af6a2f1e
MD5 230473f104c78fd95392877a8b2b5d28
SHA1 7256e235664fbdea168155f97c114ec1dcb0e714
SHA512 9110e6fa7deea5528464707a91310eec1f47a2ad99ae15a3b5fbdc32692fd0a0b61629aa4ce28513dd66ad206bc080f6afc639ea7020e2799dc6881c2b6352ab
SSDEEP 3072:ULRkgUA1nQZwFGVO4Mqg+WDaasdDOFHbAMCaExJO1EbddHsXDIWm6QIsukNwrwE0:ULRp1nQ4QL9OtbMrbqNsarwp
TLSH
T10284C616FF9188B5D4A20D304961E79D572ABC58D9538E5B31882ECEFFF1AC08E24A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan rat xworm

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-30_230473f104c78fd95392877a8b2b5d28_cobalt-strike_elex_glassworm_icedid_xworm

File Explorer

2026-05-30_230473f104c78fd95392877a8b2b5d28_cobalt-strike_elex_glassworm_icedid_xworm

.exe 375KB

2026-05-30_230473f104c78fd95392877a8b2b5d28_cobalt-strike_elex_glassworm_icedid_xworm

IMPHASH cf63b81dd7450773fe5d34299f963c66
SHA256 b978f16b0faf28cfb2e8d7c120a3f6b7ccb73ff71110c99943e1ccb2af6a2f1e
MD5 230473f104c78fd95392877a8b2b5d28
SHA1 7256e235664fbdea168155f97c114ec1dcb0e714
SHA512 9110e6fa7deea5528464707a91310eec1f47a2ad99ae15a3b5fbdc32692fd0a0b61629aa4ce28513dd66ad206bc080f6afc639ea7020e2799dc6881c2b6352ab
SSDEEP 3072:ULRkgUA1nQZwFGVO4Mqg+WDaasdDOFHbAMCaExJO1EbddHsXDIWm6QIsukNwrwE0:ULRp1nQ4QL9OtbMrbqNsarwp
TLSH
T10284C616FF9188B5D4A20D304961E79D572ABC58D9538E5B31882ECEFFF1AC08E24A35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detect Xworm Payload
Detects Windows executables referencing non-Windows User-Agents
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2b:c9:33:7f:ca:4b:ca:d3:0f:7b:19:9d:65:12:7e:a5:c6:2b:29:92

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 31, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Minor OS version

1

Major OS version

5

Entry point

6617

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x86\ship\setupexe\x-none\setup.pdb

kernel32

GetLastError SetLastError GetModuleFileNameW GetModuleHandleA OutputDebugStringA GetProcAddress LoadLibraryW FormatMessageW VerifyVersionInfoW GetModuleHandleW VerSetConditionMask QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RaiseException RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapSize GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc HeapReAlloc GetProcessHeap CloseHandle FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CreateFileW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-30_230473f104c78fd95392877a8b2b5d28_cobalt-strike_elex_glassworm_icedid_xworm

PE Signature issue

kernel32

generic