Malicious
Malicious

52f0f97c2b37082cd7bb4e84eb858edc

PE Executable
MD5: 52f0f97c2b37082cd7bb4e84eb858edc
Size: 457.73 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 447 KB PE Executable identified by Malva.RE as XWorm / Vidar Stealer (rat, stealer). Static analysis extracted 20 embedded or derived files and a malware configuration (XWorm config.). It matches 23 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185
MD5
52f0f97c2b37082cd7bb4e84eb858edc
Verdict
Malicious
File type
PE Executable · 447 KB
Family
XWormVidar Stealer
Category
RAT, Stealer

Cite this report: https://app.malva.re/sha256/d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
457.73 KB · 457,728 B
First seen
2026-10-28 10:30 · 10 hours ago
Last seen
2026-10-28 10:30 · 10 hours ago
Last analysis
2026-10-28 10:30 · 10 hours ago
Hashes
MD5 52f0f97c2b37082cd7bb4e84eb858edc Sha1 5be392240dad62debeb59f384425ca4d069a4e86 Sha256 d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 Sha384 f8858b2c2f71042064f7e601ca9457746187972676efec83dc18db7064cbc5ec1f5891e1c87dc63ad2245997dbdf7332 Sha512 c6757ffe8acb0d0349598dee6b7b60b7fde0cd1684724575411cf98942b71f0e6853e472cc7970812b89015c999c5f60b49e07e6e5b57e6de62ed1bd995b02b3 SSDeep 6144:2p/KlSbk6+0f+BLtABPDsthn9pXsBbwopWVo0kjafTiElI1D0REaX:FQ+3tlwRwopOo00p1DRaX TLSH 90A4B38A1E9446B7D3AEE67490B3333D437BA8397BABDF4D984A3D9917323488500753
Detection
PeID
Borland Delphi 7 - Nstd EP - ASL sign HQR data file

1 malicious · 12 files
EXE52f0f97c2b37082cd7bb4e84eb858edcXWorm
Structure
BINResources
BINRT_RCDATA
BINID:0000
BINID:0
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
malicious 5 nodes
Path pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious 5 nodes

Config. Field Value
Mutex S9bqEhuhuhuhuhuhuhu
Pastebin https:huhuhuhuhuhuhuhuhuhuhu
KEY <6huhuhuhu
USBNM <XWhuhuhuhu
LoggerPath %Phuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Mutex MUTEXmalicious
S9bqEhuhuhuhuhuhuhu
Pastebin URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

1 malicious · 12 files
EXE52f0f97c2b37082cd7bb4e84eb858edcXWorm
Structure

Config. Field Value
Mutex S9bqEhuhuhuhuhuhuhu
Pastebin https:huhuhuhuhuhuhuhuhuhuhu
KEY <6huhuhuhu
USBNM <XWhuhuhuhu
LoggerPath %Phuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Mutex MUTEXmalicious
S9bqEhuhuhuhuhuhuhu
52f0f97c2b37082cd7bb4e84eb858edc › Resources › RT_RCDATA › ID:0000 › ID:0
Pastebin URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
52f0f97c2b37082cd7bb4e84eb858edc › Resources › RT_RCDATA › ID:0000 › ID:0
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙