xworm | f3ae4f84ed251fab6fd84c498cef229c7435715c9597ddd612a81265b011baf4

General

Target
2026-08-19_8a5efe400acbb7d0bc857100ef08a400_cobalt-strike_icedid_njrat_satacom
Size 303KB
Sample260820-afbejayyex
SHA256 f3ae4f84ed251fab6fd84c498cef229c7435715c9597ddd612a81265b011baf4
MD5 8a5efe400acbb7d0bc857100ef08a400
SHA1 caaad6c64a2a3bf2f5612c1d86e6ee2eacdbc790
SHA512 b6750e059c8b96cbbbf2a277d218c8f6e8d8030c4c7b0a025c8e49092d2e8714c9d1b71e1c1bcc344ef78912c62a5f9ea06d6db47798d38796b8d3219dcd41c4
SSDEEP 6144:fMyyWXo3IYn5bi5eqwo4fb2lkoYXqfnq+ONMg2P21:fMpWsXi5eZb2fYXZ7M90
TLSH
T1D164BE6776A636F4D062D63DC9218116F7B3B838132587EF46A442B52F137E08F39B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

eMwLDu5sTEOm2KaT

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  2026-08-19_8a5efe400acbb7d0bc857100ef08a400_cobalt-strike_icedid_njrat_satacom
- Size 303KB
- SHA256 f3ae4f84ed251fab6fd84c498cef229c7435715c9597ddd612a81265b011baf4
- MD5 8a5efe400acbb7d0bc857100ef08a400
- SHA1 caaad6c64a2a3bf2f5612c1d86e6ee2eacdbc790
- SHA512 b6750e059c8b96cbbbf2a277d218c8f6e8d8030c4c7b0a025c8e49092d2e8714c9d1b71e1c1bcc344ef78912c62a5f9ea06d6db47798d38796b8d3219dcd41c4
- SSDEEP 6144:fMyyWXo3IYn5bi5eqwo4fb2lkoYXqfnq+ONMg2P21:fMpWsXi5eZb2fYXZ7M90
- TLSH
  T1D164BE6776A636F4D062D63DC9218116F7B3B838132587EF46A442B52F137E08F39B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks system information in the registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2