xworm | 906887569497e2db1aa18e412e74043d4c2b1c43ec25a55ab7bf611f2a05d99a

General

Target
2026-07-24_06bb2f0ec60a1c04d0397dea72138b6d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 8.2MB
Sample260724-lpezvswxds
SHA256 906887569497e2db1aa18e412e74043d4c2b1c43ec25a55ab7bf611f2a05d99a
MD5 06bb2f0ec60a1c04d0397dea72138b6d
SHA1 8a21a324cfa7bb26d99f1e36a3ee67c2ccbe3584
SHA512 2a630caae9bd9937145ab52eb98c6978b66b471e9e298332047df3edd96d5f02cbbef90187ce8e72311f346bdef77f9985d83013b9e331264ccd679c349a4524
SSDEEP 196608:ea1o4xT6AkN/EF3TauxYkReNTfm/pf+xiRyrRTj:eAsAUEF3JukSy/pWoRyrRH
TLSH
T125863398ABA008F2F5A3593986A3C114D6B1FC175728CFCB83486E699F37AD14D33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-24_06bb2f0ec60a1c04d0397dea72138b6d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 8.2MB
- SHA256 906887569497e2db1aa18e412e74043d4c2b1c43ec25a55ab7bf611f2a05d99a
- MD5 06bb2f0ec60a1c04d0397dea72138b6d
- SHA1 8a21a324cfa7bb26d99f1e36a3ee67c2ccbe3584
- SHA512 2a630caae9bd9937145ab52eb98c6978b66b471e9e298332047df3edd96d5f02cbbef90187ce8e72311f346bdef77f9985d83013b9e331264ccd679c349a4524
- SSDEEP 196608:ea1o4xT6AkN/EF3TauxYkReNTfm/pf+xiRyrRTj:eAsAUEF3JukSy/pWoRyrRH
- TLSH
  T125863398ABA008F2F5A3593986A3C114D6B1FC175728CFCB83486E699F37AD14D33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xworm rat trojan upx
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

4

T1497

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

4

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect Xworm Payload

Family: Xworm

Enumerates VirtualBox registry keys

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Looks for VMWare services registry key.

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2