Malicious
PE Executable
MD5: 52f0f97c2b37082cd7bb4e84eb858edc
Size: 457.73 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 447 KB PE Executable identified by Malva.RE as XWorm / Vidar Stealer (rat, stealer). Static analysis extracted 20 embedded or derived files and a malware configuration (XWorm config.). It matches 23 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185
- MD5
- 52f0f97c2b37082cd7bb4e84eb858edc
- Verdict
- Malicious
- File type
- PE Executable · 447 KB
- Family
- XWormVidar Stealer
- Category
- RAT, Stealer
Cite this report: https://app.malva.re/sha256/d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185
Related XWorm samples
- 1891b91cbe07657794700e6c8eab5ef7a4c64ed0fb8ab1e1f14fdef66c074386 2026-10-28
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd 2026-10-28
- 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e 2026-10-28
- b4ad9b09c0119579e88b7627b9c48625934b1bd0a90fade337cd0d2281825513 2026-10-28
- 53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5 2026-10-28
- 9b6ba2ef41d4ba43c707f274f4b5c9b41ed41db6a99959821b983838495093cf 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
457.73 KB · 457,728 B
First seen
2026-10-28 10:30 · 10 hours ago
Last seen
2026-10-28 10:30 · 10 hours ago
Last analysis
2026-10-28 10:30 · 10 hours ago
Hashes
MD5
52f0f97c2b37082cd7bb4e84eb858edc
Sha1
5be392240dad62debeb59f384425ca4d069a4e86
Sha256
d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185
Sha384
f8858b2c2f71042064f7e601ca9457746187972676efec83dc18db7064cbc5ec1f5891e1c87dc63ad2245997dbdf7332
Sha512
c6757ffe8acb0d0349598dee6b7b60b7fde0cd1684724575411cf98942b71f0e6853e472cc7970812b89015c999c5f60b49e07e6e5b57e6de62ed1bd995b02b3
SSDeep
6144:2p/KlSbk6+0f+BLtABPDsthn9pXsBbwopWVo0kjafTiElI1D0REaX:FQ+3tlwRwopOo00p1DRaX
TLSH
90A4B38A1E9446B7D3AEE67490B3333D437BA8397BABDF4D984A3D9917323488500753
Detection
PeID
Borland Delphi 7 - Nstd EP - ASL sign HQR data file
1 malicious · 12 files
EXE52f0f97c2b37082cd7bb4e84eb858edcXWorm
Structure
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
Shape
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
malicious
5 nodes
Path
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
5 nodes
| Config. Field | Value |
|---|---|
| Mutex | S9bqEhuhuhuhuhuhuhu |
| Pastebin | https:huhuhuhuhuhuhuhuhuhuhu |
| KEY | <6huhuhuhu |
| USBNM | <XWhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialMutex
MUTEXmalicious
S9bqEhuhuhuhuhuhuhu
Pastebin
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential