xworm | 3f9a217625031871096a49f296c497f30200fa86e319cb3191c8f01100eee361

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 06:32

Target
2026-08-08_64aae2854cf7239c8edcd9b21ef16baa_cobalt-strike_elex_glassworm_icedid_xworm.exe
Size 157KB
Sample260808-hanfxavyhy
SHA256 3f9a217625031871096a49f296c497f30200fa86e319cb3191c8f01100eee361
MD5 64aae2854cf7239c8edcd9b21ef16baa
SHA1 78242ce05d1d6ac6ec1cba63122b8d318e7b16f3
SHA512 c4a6c45021c2446c896eeac506e35235f76f35f04e4ce64190da4814eb6795c860932e18c52fe329cb879e8532ee246df6e5a17bb2bdd259cd2ef3b1c0e64f7c
SSDEEP 3072:Qu/msHasdDOFHbAMCaExJO1EbddRsXB/IWm6rIsJkKwrwEOve:Qu/msHOtbMrtE8skrwW
TLSH
T14AF33A14FB924DDAD0AB5E3548B157855B36BCA91F62DB1F348C220E2E36384CE24F78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4636-0-0x0000000000550000-0x0000000000566000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral1/memory/4636-0-0x0000000000550000-0x0000000000566000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

C:\Users\Admin\AppData\Local\Temp\2026-08-08_64aae2854cf7239c8edcd9b21ef16baa_cobalt-strike_elex_glassworm_icedid_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_64aae2854cf7239c8edcd9b21ef16baa_cobalt-strike_elex_glassworm_icedid_xworm.exe"
1⤵
PID:4636

memory/4636-0-0x0000000000550000-0x0000000000566000-memory.dmp

Download