xworm | 2026-10-11_3f3a74528e35aa57ed444d0dfc803f15_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_3f3a74528e35aa57ed444d0dfc803f15_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm
Size 574KB
Sample261012-3nbpgsfd82
SHA256 1848f2be493beedca185dbefe04e027c475efb62ec276dcdada7962f2296c581
MD5 3f3a74528e35aa57ed444d0dfc803f15
SHA1 fb5705737b29487bec7e0bb5f13e52abb86807e3
SHA512 a951b9d09ba6ddbd99f52a535401297366f95bc7d3068c2da2bf9d5d657e50b4331883f4fcbb9771262a2eaf8a1e1aceae8206e72c8a5f6ad643cb1fc81b881b
SSDEEP 12288:hB+B+MRMIh6YyDi5rNiQ7uysMFZzN/E/msumG7/QB+B+MRMIh0:hB+BxRjDyvgUGkB+BxRjO
TLSH
T158C49F03F79048F9E4A7893489A285559E3A7C960B71DDEF27C8432D1F327E08E39B65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan rat xworm

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-11_3f3a74528e35aa57ed444d0dfc803f15_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

File Explorer

2026-10-11_3f3a74528e35aa57ed444d0dfc803f15_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

.exe 574KB

2026-10-11_3f3a74528e35aa57ed444d0dfc803f15_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

IMPHASH 71395dc0f2e96d6793e63bc299f4ab99
SHA256 1848f2be493beedca185dbefe04e027c475efb62ec276dcdada7962f2296c581
MD5 3f3a74528e35aa57ed444d0dfc803f15
SHA1 fb5705737b29487bec7e0bb5f13e52abb86807e3
SHA512 a951b9d09ba6ddbd99f52a535401297366f95bc7d3068c2da2bf9d5d657e50b4331883f4fcbb9771262a2eaf8a1e1aceae8206e72c8a5f6ad643cb1fc81b881b
SSDEEP 12288:hB+B+MRMIh6YyDi5rNiQ7uysMFZzN/E/msumG7/QB+B+MRMIh0:hB+BxRjDyvgUGkB+BxRjO
TLSH
T158C49F03F79048F9E4A7893489A285559E3A7C960B71DDEF27C8432D1F327E08E39B65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detect Xworm Payload
Detects Windows executables referencing non-Windows User-Agents
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4a:25:7e:0a:57:d7:71:ec:46:40:e7:8f:3c:ce:1d:24:79:3d:8c:d6:f5:75:c5:7e:e4:13:c2:27:03:bb:69:e7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Chains

Mar 2, 2020

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

f3:8b:4f:e9:8f:17:a9:2a:43:fe:9d:5e:af:78:4a:7e:41:32:3b:78

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

Mar 2, 2020

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

06:ae:a7:6b:ac:46:a9:e8:cf:e6:d2:9e:45:aa:f0:33

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 8, 2019 - Nov 16, 2022

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Serial Number

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 7, 2018 - Nov 17, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

5295

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleUpdateOnDemand_unsigned.pdb

2026-10-11_3f3a74528e35aa57ed444d0dfc803f15_amadey_cobalt-strike_elex_glassworm_icedid_remcos_stealc_vidar_xworm

PE Signature issue

PE Signature issue

kernel32

shlwapi

generic