xworm | c2314b6ce945fc0d8d6b0879959a31bf7e47b5f65efd3ba6db87e60b97b59a50

General

Target
2026-08-21_c7bcc164fb4095eb30642f5d44a9db26_cobalt-strike_icedid_satacom
Size 274KB
Sample260821-krlprawgmd
SHA256 c2314b6ce945fc0d8d6b0879959a31bf7e47b5f65efd3ba6db87e60b97b59a50
MD5 c7bcc164fb4095eb30642f5d44a9db26
SHA1 f7da58a67003c9c4ea027f4527ce4fe719f50ab4
SHA512 5b7c591b1617fd8ecf12c612aefd34213dba07f7c59cfae1e907300b4139c153250c3308725acf3eaf68635a2dafc093762346fd6dfcdca1698c4b52cf3c7dfb
SSDEEP 6144:MVKlyesyB5zrlRcg7hJkk2V9H1hEivb/CvQiRksyaqFuBge:MVKsyB5z9ckuH1eivYN4Cj
TLSH
T1B554CF7776A532F5C1A6D239D5118011E7A2F439232993EF5BA482B51F133E0CF78EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

eMwLDu5sTEOm2KaT

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  2026-08-21_c7bcc164fb4095eb30642f5d44a9db26_cobalt-strike_icedid_satacom
- Size 274KB
- SHA256 c2314b6ce945fc0d8d6b0879959a31bf7e47b5f65efd3ba6db87e60b97b59a50
- MD5 c7bcc164fb4095eb30642f5d44a9db26
- SHA1 f7da58a67003c9c4ea027f4527ce4fe719f50ab4
- SHA512 5b7c591b1617fd8ecf12c612aefd34213dba07f7c59cfae1e907300b4139c153250c3308725acf3eaf68635a2dafc093762346fd6dfcdca1698c4b52cf3c7dfb
- SSDEEP 6144:MVKlyesyB5zrlRcg7hJkk2V9H1hEivb/CvQiRksyaqFuBge:MVKsyB5z9ckuH1eivYN4Cj
- TLSH
  T1B554CF7776A532F5C1A6D239D5118011E7A2F439232993EF5BA482B51F133E0CF78EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks system information in the registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2