Malicious
Malicious

c7371d1fb21b6d31fb829e467263ef33

Share on LinkedIn
Print
PE Executable
MD5: c7371d1fb21b6d31fb829e467263ef33
Size: 10.17 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 9.7 MB PE Executable identified by Malva.RE as XWorm / Vidar Stealer (rat, stealer). Static analysis extracted 33 embedded or derived files, a malware configuration (XWorm config.) and 1 command-and-control endpoint. It matches 63 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc
MD5
c7371d1fb21b6d31fb829e467263ef33
Verdict
Malicious
File type
PE Executable · 9.7 MB
Family
XWormVidar Stealer
Category
RAT, Stealer
C2 (defanged)
tcp[.]cloudpub[.]ru

Cite this report: https://app.malva.re/sha256/c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
10.17 MB · 10,172,416 B
First seen
2026-10-29 07:45 · an hour ago
Last seen
2026-10-29 07:45 · an hour ago
Last analysis
2026-10-29 08:01 · an hour ago
Hashes
MD5 c7371d1fb21b6d31fb829e467263ef33 Sha1 cb298760e2361a4cd44c295513fd61c2d061e6cc Sha256 c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc Sha384 3acb57d885c3316eac3936bcbd3a513a3b494d7e8a23e0b04fb18129bdc6323156607fb528b88282e67b6b17c18ede34 Sha512 249fc36cbac47d395f0c2600737384fad40847f08712772e3cbe3fc90f36fcab700439554a74602f3c8feb6a2464fc8e8d9c95d84a184ecdae140403319e6aa2 SSDeep 196608:UjM6PcdmtH7YIm8qDPPrQ/PYioYjM6PcdmtH7YIm8qDPPrQ/PYioL:ePdtH7YImzDPc/ATqPdtH7YImzDPc/AH TLSH 0DA6230437E54625E2FF5BB8D4B1625583B5F623B82BDB4E6C8421DE1937B84CE01BA3
Detection
PeID
Borland Delphi 7 - Nstd EP - ASL sign HQR data fileUPolyX 0.3 -> delikon

1 malicious · 9 files
EXEc7371d1fb21b6d31fb829e467263ef33XWorm
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:rsrc>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious 7 nodes
Path pe:exe>pe:rsrc>pe:exe>pe:rsrc>pe:exe>bin
Shape pe:exe>pe:rsrc>pe:exe>pe:rsrc>pe:exe>bin
malicious 6 nodes

Config. Field Value
Mutex yuIW8huhuhuhuhuhuhu
Hosts tcp.chuhuhuhuhuhuhu
Port 5huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Phuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
Mutex mAUCShuhuhuhuhuhuhu
Hosts tcp.chuhuhuhuhuhuhu
Port 5huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
Mutex diw5ihuhuhuhuhuhuhu
Hosts tcp.chuhuhuhuhuhuhu
Port 5huhuhuhu
KEY <12huhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Phuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Mutex MUTEXmalicious
yuIW8huhuhuhuhuhuhu
CnC CNCmalicious
tcp.chuhuhuhuhuhuhu
Port PORTmalicious
5huhuhuhu
Mutex MUTEXmalicious
mAUCShuhuhuhuhuhuhu
Port PORTmalicious
5huhuhuhu
Mutex MUTEXmalicious
diw5ihuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙