xworm | 4ba6da15b1af90407885ce57ceab423224fcf6a2e2688680d0518a4ecd020a44

General

Target
2026-10-22_80314a48b8c9e3f64132083824f2721f_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_smoke-loader_stealc_tofsee_vidar_xworm
Size 563KB
Sample261024-hwm29sat3m
SHA256 4ba6da15b1af90407885ce57ceab423224fcf6a2e2688680d0518a4ecd020a44
MD5 80314a48b8c9e3f64132083824f2721f
SHA1 3d47bdae03f5dee6d156854bfa0265fcababaab7
SHA512 88f6c8ece3d182d3b757b062fe8ce02b46548cf4fbdd3b8dd986ca379414af62b57a75c710c281bc63917a710ca0e687f00b3d11ef3f37d8fc0e44ea112f245b
SSDEEP 12288:jYSDi5eJQ7uysMFZzN/dmBm1GA26NdsvKdlg8Cl6oTtvkZQ:E6vgKBjd6BdrClvTeZQ
TLSH
T124C4BE11F38044F9D4A7847489A68A529E3A7CAE1B70E9DF27DC622A1F337E04E3C755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-22_80314a48b8c9e3f64132083824f2721f_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_smoke-loader_stealc_tofsee_vidar_xworm
- Size 563KB
- SHA256 4ba6da15b1af90407885ce57ceab423224fcf6a2e2688680d0518a4ecd020a44
- MD5 80314a48b8c9e3f64132083824f2721f
- SHA1 3d47bdae03f5dee6d156854bfa0265fcababaab7
- SHA512 88f6c8ece3d182d3b757b062fe8ce02b46548cf4fbdd3b8dd986ca379414af62b57a75c710c281bc63917a710ca0e687f00b3d11ef3f37d8fc0e44ea112f245b
- SSDEEP 12288:jYSDi5eJQ7uysMFZzN/dmBm1GA26NdsvKdlg8Cl6oTtvkZQ:E6vgKBjd6BdrClvTeZQ
- TLSH
  T124C4BE11F38044F9D4A7847489A68A529E3A7CAE1B70E9DF27DC622A1F337E04E3C755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery xworm persistence rat spyware stealer trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Custom signature
  
  Detects Windows executables referencing non-Windows User-Agents
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2