Malicious
549407b4e39812fc331b24e322e00283
PE Executable
MD5: 549407b4e39812fc331b24e322e00283
Size: 469.5 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 458.5 KB PE Executable identified by Malva.RE as XWorm / Vidar Stealer (rat, stealer). Static analysis extracted 20 embedded or derived files, a malware configuration (XWorm config.) and 1 command-and-control endpoint. It matches 23 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c
- MD5
- 549407b4e39812fc331b24e322e00283
- Verdict
- Malicious
- File type
- PE Executable · 458.5 KB
- Family
- XWormVidar Stealer
- Category
- RAT, Stealer
- C2 (defanged)
ov1j9h5mhk[.]localto[.]net
Cite this report: https://app.malva.re/sha256/f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c
Related XWorm samples
- c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc 2026-10-29
- 1891b91cbe07657794700e6c8eab5ef7a4c64ed0fb8ab1e1f14fdef66c074386 2026-10-28
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 2026-10-28
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd 2026-10-28
- 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e 2026-10-28
- b4ad9b09c0119579e88b7627b9c48625934b1bd0a90fade337cd0d2281825513 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
469.5 KB · 469,504 B
First seen
2026-10-29 00:15 · 10 hours ago
Last seen
2026-10-29 00:15 · 10 hours ago
Last analysis
2026-10-29 00:15 · 10 hours ago
Hashes
MD5
549407b4e39812fc331b24e322e00283
Sha1
a5ec29d2d7de5ef3549d20af8d1ee5026999688a
Sha256
f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c
Sha384
fedc6deaa8bcc876c1ac33613b3957c120fc3b3deadfd70efc3b658ccb0466d10820cadd187f3d09fb02eef60de0e92d
Sha512
7c596a13d9be39ea0570b03028350c5839defc67ed4bbf702e8fbb882500197bb336237a7bc5c2875324a9d5d11cc917f03fb7bf26aa96d1f13cdf5a0de07014
SSDeep
6144:yUMbbqTSf+BLtABPDsthn9pXsBbwopWVo0kjafTiElI1D0REa0:cqT5tlwRwopOo00p1DRa0
TLSH
42A4C58A1E9446B7D3AEE67494B3333C837BA8397BA7DF4D984A3D9917323488500753
Detection
PeID
Borland Delphi 7 - Nstd EP - ASL sign HQR data file
1 malicious · 12 files
EXE549407b4e39812fc331b24e322e00283XWorm
Structure
BINResources
BINRT_RCDATA
BINID:0000
BINID:0
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
Shape
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
malicious
5 nodes
Path
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
5 nodes
| Config. Field | Value |
|---|---|
| Mutex | UXITKhuhuhuhuhuhuhu |
| Hosts | ov1j9hhuhuhuhuhuhuhu |
| Port | 6huhuhuhu |
| KEY | <12huhuhuhu |
| USBNM | <Xwhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialMutex
MUTEXmalicious
UXITKhuhuhuhuhuhuhu
CnC
CNCmalicious
ov1j9hhuhuhuhuhuhuhu
Port
PORTmalicious
6huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 12 files
EXE549407b4e39812fc331b24e322e00283XWorm
Structure
BINResources
| Config. Field | Value |
|---|---|
| Mutex | UXITKhuhuhuhuhuhuhu |
| Hosts | ov1j9hhuhuhuhuhuhuhu |
| Port | 6huhuhuhu |
| KEY | <12huhuhuhu |
| USBNM | <Xwhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialMutex
MUTEXmalicious
UXITKhuhuhuhuhuhuhu
549407b4e39812fc331b24e322e00283 › Resources › RT_RCDATA › ID:0000 › ID:0
CnC
CNCmalicious
ov1j9hhuhuhuhuhuhuhu
549407b4e39812fc331b24e322e00283 › Resources › RT_RCDATA › ID:0000 › ID:0
Port
PORTmalicious
6huhuhuhu
549407b4e39812fc331b24e322e00283 › Resources › RT_RCDATA › ID:0000 › ID:0
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account