xworm | e250cd282d22fbfb1dba0ecfa4b605a34ca261ec8fef7c8d50f769498cda1bea

General

Target
2026-08-15_018a2c21222066f22675a9cb652854b8_cobalt-strike_icedid_njrat_satacom
Size 311KB
Sample260815-rt3jlsdj6z
SHA256 e250cd282d22fbfb1dba0ecfa4b605a34ca261ec8fef7c8d50f769498cda1bea
MD5 018a2c21222066f22675a9cb652854b8
SHA1 0535376c0ab7f11f037f32bf285c6ae604c79be7
SHA512 964ae8c2e601cf2f1658e6733b9a1d2096527c4b4cd39a0d800d32a1bbf431cb4741e33dd671913d31c1e4586061b326cbd6bc90bc01747e31ceb0053815542d
SSDEEP 6144:vcQKiR2C5chXrQaYtEU5RWRB5zIDimiR7+uR6OF31Klz/Px:vc3iR2HVrQwMQsk+uFKZPx
TLSH
T13064BF6776A636F5C156D63885218506F7B3B439232083EF4BA442BA2F137E48F39F61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

eMwLDu5sTEOm2KaT

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  2026-08-15_018a2c21222066f22675a9cb652854b8_cobalt-strike_icedid_njrat_satacom
- Size 311KB
- SHA256 e250cd282d22fbfb1dba0ecfa4b605a34ca261ec8fef7c8d50f769498cda1bea
- MD5 018a2c21222066f22675a9cb652854b8
- SHA1 0535376c0ab7f11f037f32bf285c6ae604c79be7
- SHA512 964ae8c2e601cf2f1658e6733b9a1d2096527c4b4cd39a0d800d32a1bbf431cb4741e33dd671913d31c1e4586061b326cbd6bc90bc01747e31ceb0053815542d
- SSDEEP 6144:vcQKiR2C5chXrQaYtEU5RWRB5zIDimiR7+uR6OF31Klz/Px:vc3iR2HVrQwMQsk+uFKZPx
- TLSH
  T13064BF6776A636F5C156D63885218506F7B3B439232083EF4BA442BA2F137E48F39F61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2