xworm | 3f9a217625031871096a49f296c497f30200fa86e319cb3191c8f01100eee361

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 06:32

Target
2026-08-08_64aae2854cf7239c8edcd9b21ef16baa_cobalt-strike_elex_glassworm_icedid_xworm.exe
Size 157KB
Sample260808-hanfxavyhy
SHA256 3f9a217625031871096a49f296c497f30200fa86e319cb3191c8f01100eee361
MD5 64aae2854cf7239c8edcd9b21ef16baa
SHA1 78242ce05d1d6ac6ec1cba63122b8d318e7b16f3
SHA512 c4a6c45021c2446c896eeac506e35235f76f35f04e4ce64190da4814eb6795c860932e18c52fe329cb879e8532ee246df6e5a17bb2bdd259cd2ef3b1c0e64f7c
SSDEEP 3072:Qu/msHasdDOFHbAMCaExJO1EbddRsXB/IWm6rIsJkKwrwEOve:Qu/msHOtbMrtE8skrwW
TLSH
T14AF33A14FB924DDAD0AB5E3548B157855B36BCA91F62DB1F348C220E2E36384CE24F78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4060-1-0x0000000000360000-0x0000000000376000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/4060-1-0x0000000000360000-0x0000000000376000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

C:\Users\Admin\AppData\Local\Temp\2026-08-08_64aae2854cf7239c8edcd9b21ef16baa_cobalt-strike_elex_glassworm_icedid_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_64aae2854cf7239c8edcd9b21ef16baa_cobalt-strike_elex_glassworm_icedid_xworm.exe"
1⤵
PID:4060

memory/4060-0-0x00007FFE2A8EF000-0x00007FFE2A8F0000-memory.dmp

Download

memory/4060-1-0x0000000000360000-0x0000000000376000-memory.dmp

Download

memory/4060-2-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4060-3-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download