xworm | 5e9439519bb2918693899d805eae0084c09e5f29131c435c130f612b9d3ac227

General

Target
2026-08-15_1fc369bd39d073604e842b09749218ab_cobalt-strike_icedid_njrat_satacom
Size 306KB
Sample260816-dflr2sycjf
SHA256 5e9439519bb2918693899d805eae0084c09e5f29131c435c130f612b9d3ac227
MD5 1fc369bd39d073604e842b09749218ab
SHA1 a7cb0f7ad0e53bb2a2c37415e818ce29f4e651fd
SHA512 a26c2609537179fcb7c5ba85b45fe9469a254e240e24d45f788011d6d3ca3effc2c78a7286f7e02c0f92cc09b231f85bc5073b0f49c3299bc7576c2c20e18fac
SSDEEP 6144:e6J3/+kECYvHgT67BdCzBGFCpn+3Oxv0bHTOmP:eg3/+kECHT6Ng0e+3Ox8bzO8
TLSH
T12C64C063BAA226F4D157D23CC9218515F373B438232597EF4BA842B56F137D08E39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

eMwLDu5sTEOm2KaT

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  2026-08-15_1fc369bd39d073604e842b09749218ab_cobalt-strike_icedid_njrat_satacom
- Size 306KB
- SHA256 5e9439519bb2918693899d805eae0084c09e5f29131c435c130f612b9d3ac227
- MD5 1fc369bd39d073604e842b09749218ab
- SHA1 a7cb0f7ad0e53bb2a2c37415e818ce29f4e651fd
- SHA512 a26c2609537179fcb7c5ba85b45fe9469a254e240e24d45f788011d6d3ca3effc2c78a7286f7e02c0f92cc09b231f85bc5073b0f49c3299bc7576c2c20e18fac
- SSDEEP 6144:e6J3/+kECYvHgT67BdCzBGFCpn+3Oxv0bHTOmP:eg3/+kECHT6Ng0e+3Ox8bzO8
- TLSH
  T12C64C063BAA226F4D157D23CC9218515F373B438232597EF4BA842B56F137D08E39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2