xworm | d64a66ba25de56e69a53d0e7c271fafc8a51979d070e975ad5c32bb80ed4a1e3

General

Target
2026-08-16_b5bfaff5a22476841c4a16dac21c5dc4_cobalt-strike_icedid_njrat_satacom
Size 314KB
Sample260816-ed8pgacn6v
SHA256 d64a66ba25de56e69a53d0e7c271fafc8a51979d070e975ad5c32bb80ed4a1e3
MD5 b5bfaff5a22476841c4a16dac21c5dc4
SHA1 6298d5e110d1876a1cdb5f2f8a911563483551d1
SHA512 2fd752df8c4a4d06936be24d696302952429c394c27c8b09aee6ae7a2b973d16c452d342772e21cc658a838407b2d2bb0219951fbe1c15eb64fcc23d3ed0952d
SSDEEP 6144:d4hEEjIVTPW1P1iDKjDZsri4B4s3jwxsRiOW9TA8UYM8I9F1:d4hXjIdq1iDK5ei40GRoe8G1
TLSH
T1C864BF6776A636F4D566D638C9204416F773B838232587EF47A842B52F132E08F39FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

eMwLDu5sTEOm2KaT

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  2026-08-16_b5bfaff5a22476841c4a16dac21c5dc4_cobalt-strike_icedid_njrat_satacom
- Size 314KB
- SHA256 d64a66ba25de56e69a53d0e7c271fafc8a51979d070e975ad5c32bb80ed4a1e3
- MD5 b5bfaff5a22476841c4a16dac21c5dc4
- SHA1 6298d5e110d1876a1cdb5f2f8a911563483551d1
- SHA512 2fd752df8c4a4d06936be24d696302952429c394c27c8b09aee6ae7a2b973d16c452d342772e21cc658a838407b2d2bb0219951fbe1c15eb64fcc23d3ed0952d
- SSDEEP 6144:d4hEEjIVTPW1P1iDKjDZsri4B4s3jwxsRiOW9TA8UYM8I9F1:d4hXjIdq1iDK5ei40GRoe8G1
- TLSH
  T1C864BF6776A636F4D566D638C9204416F773B838232587EF47A842B52F132E08F39FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2