xworm | 2026-10-11_9b08e559022f6f276aae082d48b9f71c_cobalt-strike_elex_glassworm_icedid_stealc_vidar_xworm

General

Target
2026-10-11_9b08e559022f6f276aae082d48b9f71c_cobalt-strike_elex_glassworm_icedid_stealc_vidar_xworm
Size 525KB
Sample261012-sg4ftaxvev
SHA256 a07b8a6a415de888ed12e45a9c6b26a7127bdfb94c0dce072c61b5e9b71a666f
MD5 9b08e559022f6f276aae082d48b9f71c
SHA1 1b22211bc78b08c0c06da1ac7ed46b26fca85173
SHA512 8652457b4dd19df578ca79aa7dd505f44de6abfc5f667eaac489573d07c0cc4f38baee1a6d37ffd3b3da12490f7ca760a64ac8ad4257eb053f49387cd2483fda
SSDEEP 12288:NQZd04T1eag9zQH+YyDi5rNiQD+ysMFZzN/E/msumG7s/:qZd04T1Y9zQRyngUGq
TLSH
T1CDB49E11F78044FDD4AB8174C5E6465A9B39B88A0B31ADDF17CC472A2F227F08E397A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan rat xworm

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-11_9b08e559022f6f276aae082d48b9f71c_cobalt-strike_elex_glassworm_icedid_stealc_vidar_xworm

File Explorer

2026-10-11_9b08e559022f6f276aae082d48b9f71c_cobalt-strike_elex_glassworm_icedid_stealc_vidar_xworm

.exe 525KB

2026-10-11_9b08e559022f6f276aae082d48b9f71c_cobalt-strike_elex_glassworm_icedid_stealc_vidar_xworm

IMPHASH 172861d7f771518bba27ebb10e326cd9
SHA256 a07b8a6a415de888ed12e45a9c6b26a7127bdfb94c0dce072c61b5e9b71a666f
MD5 9b08e559022f6f276aae082d48b9f71c
SHA1 1b22211bc78b08c0c06da1ac7ed46b26fca85173
SHA512 8652457b4dd19df578ca79aa7dd505f44de6abfc5f667eaac489573d07c0cc4f38baee1a6d37ffd3b3da12490f7ca760a64ac8ad4257eb053f49387cd2483fda
SSDEEP 12288:NQZd04T1eag9zQH+YyDi5rNiQD+ysMFZzN/E/msumG7s/:qZd04T1Y9zQRyngUGq
TLSH
T1CDB49E11F78044FDD4AB8174C5E6465A9B39B88A0B31ADDF17CC472A2F227F08E397A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detect Xworm Payload
Detects Windows executables referencing non-Windows User-Agents
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

79:a9:35:26:31:c9:50:2a:bc:53:84:45:8e:2b:56:d5:9b:10:5e:9b:63:ee:d9:5f:42:68:75:f1:06:47:83:b4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Dec 11, 2019

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

59:7e:4e:45:cb:c1:15:bb:a6:40:26:02:e8:9c:bf:45

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 26, 2018 - Feb 27, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

102698

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\ade\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u241\331\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-10-11_9b08e559022f6f276aae082d48b9f71c_cobalt-strike_elex_glassworm_icedid_stealc_vidar_xworm

PE Signature issue

msvcr100

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_9b08e559022f6f276aae082d48b9f71c_cobalt-strike_elex_glassworm_icedid_stealc_vidar_xworm

PE Signature issue

msvcr100

kernel32

generic