xworm | 32e3392a1a58760c2e83265fd69663a66e79dd1f3a3db2a2146b8a053bff23bd

General

Target
2026-08-03_3ab86892c71b1abc100283f000bce0c8_conti_elex
Size 335KB
Sample260804-pktt1aen3x
SHA256 32e3392a1a58760c2e83265fd69663a66e79dd1f3a3db2a2146b8a053bff23bd
MD5 3ab86892c71b1abc100283f000bce0c8
SHA1 8e690b9e90a74a174f2146f7c59464694babcc2f
SHA512 35c371ffd8c0ca9ac2095fe5815fae1e770e8b3c7a91be3892b39e5f99065fb62e68e55179c567c4e1bd2dcd2b6edb9516c46670fcda56c0b3aa2211386da394
SSDEEP 6144:QFCMxlMejspK1cOXYCJ69lZF/QgfbCx0bF4Zu2D0kHWb3aCUtFa9rip:QFbxljspK1cOXYCJclZWgfbCiF4rbE3u
TLSH
T153745B49FB8310F5EA0B5AF98CDBD7BBC72476558126DAB7FB8DCA05B4233021C85285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

13.50.224.130:6969

Mutex

KWTagKs88xBA3brW

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  2026-08-03_3ab86892c71b1abc100283f000bce0c8_conti_elex
- Size 335KB
- SHA256 32e3392a1a58760c2e83265fd69663a66e79dd1f3a3db2a2146b8a053bff23bd
- MD5 3ab86892c71b1abc100283f000bce0c8
- SHA1 8e690b9e90a74a174f2146f7c59464694babcc2f
- SHA512 35c371ffd8c0ca9ac2095fe5815fae1e770e8b3c7a91be3892b39e5f99065fb62e68e55179c567c4e1bd2dcd2b6edb9516c46670fcda56c0b3aa2211386da394
- SSDEEP 6144:QFCMxlMejspK1cOXYCJ69lZF/QgfbCx0bF4Zu2D0kHWb3aCUtFa9rip:QFbxljspK1cOXYCJclZWgfbCiF4rbE3u
- TLSH
  T153745B49FB8310F5EA0B5AF98CDBD7BBC72476558126DAB7FB8DCA05B4233021C85285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2