xworm | 7938fdff03450fca363cdaddd2a9e1b6512c0415df48dd148bf06e74c79e8998

General

Target
2026-09-06_4f58ff3247474323b0ae33d8c6f55371_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 548KB
Sample260907-d5f8vsbr6z
SHA256 7938fdff03450fca363cdaddd2a9e1b6512c0415df48dd148bf06e74c79e8998
MD5 4f58ff3247474323b0ae33d8c6f55371
SHA1 612ec7a530b1375049ec2e032064f9f5c4ca4073
SHA512 1996d5eb8bca7bb38b7c8b37dd833cc1383485548e1960e48b8424ec642eeaf7103a8b5596ad3d71d2b5da8c88cb4dccaa31072d92f3c9f204bdcb35a8f55c94
SSDEEP 12288:RmiMZvN43+u85Bpw+YMRkc9kMh8lbC4vH3SDRxAm:UnvS+55BpfRX9kMytjXSDh
TLSH
T146C48E19F7E404F9E0B7E578CD934B02E776F84907B1E68F03A499A61F232909D39792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

ZuW3RxO2SRjafCGt

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  2026-09-06_4f58ff3247474323b0ae33d8c6f55371_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 548KB
- SHA256 7938fdff03450fca363cdaddd2a9e1b6512c0415df48dd148bf06e74c79e8998
- MD5 4f58ff3247474323b0ae33d8c6f55371
- SHA1 612ec7a530b1375049ec2e032064f9f5c4ca4073
- SHA512 1996d5eb8bca7bb38b7c8b37dd833cc1383485548e1960e48b8424ec642eeaf7103a8b5596ad3d71d2b5da8c88cb4dccaa31072d92f3c9f204bdcb35a8f55c94
- SSDEEP 12288:RmiMZvN43+u85Bpw+YMRkc9kMh8lbC4vH3SDRxAm:UnvS+55BpfRX9kMytjXSDh
- TLSH
  T146C48E19F7E404F9E0B7E578CD934B02E776F84907B1E68F03A499A61F232909D39792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detects Windows executables referencing non-Windows User-Agents
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Detects Windows executables referencing non-Windows User-Agents

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2