Malicious
PE Executable
MD5: 46ef17a9921faac9a01050d1abd34466
Size: 364.54 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 356 KB PE Executable identified by Malva.RE as XWorm / Vidar Stealer (rat, stealer). Static analysis extracted 12 embedded or derived files and a malware configuration (XWorm config.). It matches 21 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b4ad9b09c0119579e88b7627b9c48625934b1bd0a90fade337cd0d2281825513
- MD5
- 46ef17a9921faac9a01050d1abd34466
- Verdict
- Malicious
- File type
- PE Executable · 356 KB
- Family
- XWormVidar Stealer
- Category
- RAT, Stealer
Cite this report: https://app.malva.re/sha256/b4ad9b09c0119579e88b7627b9c48625934b1bd0a90fade337cd0d2281825513
Related XWorm samples
- 1891b91cbe07657794700e6c8eab5ef7a4c64ed0fb8ab1e1f14fdef66c074386 2026-10-28
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 2026-10-28
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd 2026-10-28
- 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e 2026-10-28
- 53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5 2026-10-28
- 9b6ba2ef41d4ba43c707f274f4b5c9b41ed41db6a99959821b983838495093cf 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
364.54 KB · 364,544 B
First seen
2026-10-28 00:30 · 20 hours ago
Last seen
2026-10-28 00:30 · 20 hours ago
Last analysis
2026-10-28 00:30 · 20 hours ago
Hashes
MD5
46ef17a9921faac9a01050d1abd34466
Sha1
6412046095b6ca18096c4b0c16144ea20d8f2350
Sha256
b4ad9b09c0119579e88b7627b9c48625934b1bd0a90fade337cd0d2281825513
Sha384
a0fac07fcb4d14cf56b231f36fbbceb26b60c157165ffad28bfde42618d1236572fa71589b2f329ec54cf0601b98ae54
Sha512
1a2728e1dc13c26457840ab2c68c3e141a8aa131b6a9f55ff3db9dbc5dc1addf2a5f83802cf31757138bc8edfd0ae14f335fc843cd83394f524c6184b85d0e0c
SSDeep
6144:buf+BLtABPDsthn9pXsBbwopWVo0kjafTiElI1D0REaZScz7Mxbqg6G3fH:JtlwRwopOo00p1DRaZScz7pgL3fH
TLSH
AD746E0427E88B16E2FF4BB8E4B05265C3B1B557B93EDB4E6C4461DE2923780C945BB3
Detection
PeID
Borland Delphi 7 - Nstd EP - ASL sign HQR data file
1 malicious · 4 files
EXE46ef17a9921faac9a01050d1abd34466XWorm
Structure
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| Mutex | %Phuhuhuhu |
| KEY | o5Slywhuhuhuhuhuhuhuhuhuhuhu |
| USBNM | %huhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialMutex
MUTEXmalicious
%Phuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential