This sample is a 458.5 KB PE Executable identified by Malva.RE as XWorm / Vidar Stealer (rat, stealer). Static analysis extracted 20 embedded or derived files, a malware configuration (XWorm config.) and 1 command-and-control endpoint. It matches 23 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c
- MD5
- 549407b4e39812fc331b24e322e00283
- Verdict
- Malicious
- File type
- PE Executable · 458.5 KB
- Family
- XWormVidar Stealer
- Category
- RAT, Stealer
- C2 (defanged)
ov1j9h5mhk[.]localto[.]net
Cite this report: https://app.malva.re/sha256/f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c
Related XWorm samples
- c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc 2026-10-29
- 1891b91cbe07657794700e6c8eab5ef7a4c64ed0fb8ab1e1f14fdef66c074386 2026-10-28
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 2026-10-28
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd 2026-10-28
- 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e 2026-10-28
- b4ad9b09c0119579e88b7627b9c48625934b1bd0a90fade337cd0d2281825513 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
| Config. Field | Value |
|---|---|
| Mutex | UXITKhuhuhuhuhuhuhu |
| Hosts | ov1j9hhuhuhuhuhuhuhu |
| Port | 6huhuhuhu |
| KEY | <12huhuhuhu |
| USBNM | <Xwhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |