xworm | c9a05ac8a76b76deca9178e129e68a861f720a87c0c2be0bf12d7befdc8c75e1

General

Target
2026-08-14_55a0c83f9123839c8e5ce1d238e908de_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 8.1MB
Sample260814-3tw8dabm7x
SHA256 c9a05ac8a76b76deca9178e129e68a861f720a87c0c2be0bf12d7befdc8c75e1
MD5 55a0c83f9123839c8e5ce1d238e908de
SHA1 bb725607fba66c4c8e44f8c1f965423e1d6d46ea
SHA512 8bda078ed1d0b1a064c7ad9ab6bf1c65a0e1e863a91e1bc83e7d6f7e51f5e44aa3ddd6a0c9d027d501564e2e9eb2346e9c28664d8c3b1b7f81444b61fa59a777
SSDEEP 196608:BCJHWgKCyQIA1HeT39IigjvKub75bcjWgbWpkzfcAkjKW8+:AyK1+TtIiavB5IjWqWpkzq
TLSH
T10C86335473F61CF9E5F3833582A28486EE72B48527B2CBCB07B406E11F5B2E24E75661
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

nuuky-78-173-142-62.run.pinggy-free.link:46399

Mutex

NSP88JwIvfBJJhk0

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  2026-08-14_55a0c83f9123839c8e5ce1d238e908de_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 8.1MB
- SHA256 c9a05ac8a76b76deca9178e129e68a861f720a87c0c2be0bf12d7befdc8c75e1
- MD5 55a0c83f9123839c8e5ce1d238e908de
- SHA1 bb725607fba66c4c8e44f8c1f965423e1d6d46ea
- SHA512 8bda078ed1d0b1a064c7ad9ab6bf1c65a0e1e863a91e1bc83e7d6f7e51f5e44aa3ddd6a0c9d027d501564e2e9eb2346e9c28664d8c3b1b7f81444b61fa59a777
- SSDEEP 196608:BCJHWgKCyQIA1HeT39IigjvKub75bcjWgbWpkzfcAkjKW8+:AyK1+TtIiavB5IjWqWpkzq
- TLSH
  T10C86335473F61CF9E5F3833582A28486EE72B48527B2CBCB07B406E11F5B2E24E75661
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2