xworm | b0fd47e16dbba365c07f29216cc3d365cb5b324c3e6fc34e7d876e97fedc9121

General

Target
2026-08-21_9973f85852c61f5ca931673274a39e6b_cobalt-strike_icedid_satacom
Size 176KB
Sample260821-mj5trssvdx
SHA256 b0fd47e16dbba365c07f29216cc3d365cb5b324c3e6fc34e7d876e97fedc9121
MD5 9973f85852c61f5ca931673274a39e6b
SHA1 43588e420ff525865d00bce496c4bc0f40a749e9
SHA512 353cfd3cec2a715bc0cb17729473de1c0dc38e0db5bfb6b62c5b3823aec9f972a2b21271255db0cc2bc723a1be01adcfd38d007b82c9fdeff272ef10193238e2
SSDEEP 3072:192Y8tqVuxNlJrjsSkqsytQQ5zB86lDeVa9kn3ob7k1vVzP:rVKlyesyB5zrlIcgYb7khV7
TLSH
T10E049D6BB2E530F5E5B3C53985914606EBB2B43607249BEF07A0476A2F233D18D3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

eMwLDu5sTEOm2KaT

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  2026-08-21_9973f85852c61f5ca931673274a39e6b_cobalt-strike_icedid_satacom
- Size 176KB
- SHA256 b0fd47e16dbba365c07f29216cc3d365cb5b324c3e6fc34e7d876e97fedc9121
- MD5 9973f85852c61f5ca931673274a39e6b
- SHA1 43588e420ff525865d00bce496c4bc0f40a749e9
- SHA512 353cfd3cec2a715bc0cb17729473de1c0dc38e0db5bfb6b62c5b3823aec9f972a2b21271255db0cc2bc723a1be01adcfd38d007b82c9fdeff272ef10193238e2
- SSDEEP 3072:192Y8tqVuxNlJrjsSkqsytQQ5zB86lDeVa9kn3ob7k1vVzP:rVKlyesyB5zrlIcgYb7khV7
- TLSH
  T10E049D6BB2E530F5E5B3C53985914606EBB2B43607249BEF07A0476A2F233D18D3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks system information in the registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2