Malicious
d6b49ebe62592843ab232a33d1e920f4
PE Executable
MD5: d6b49ebe62592843ab232a33d1e920f4
Size: 474.62 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 463.5 KB PE Executable identified by Malva.RE as XWorm / Vidar Stealer (rat, stealer). Static analysis extracted 19 embedded or derived files, a malware configuration (XWorm config.) and 1 command-and-control endpoint. It matches 23 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd
- MD5
- d6b49ebe62592843ab232a33d1e920f4
- Verdict
- Malicious
- File type
- PE Executable · 463.5 KB
- Family
- XWormVidar Stealer
- Category
- RAT, Stealer
- C2 (defanged)
tcp[.]cloudpub[.]ru
Cite this report: https://app.malva.re/sha256/9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd
Related XWorm samples
- 1891b91cbe07657794700e6c8eab5ef7a4c64ed0fb8ab1e1f14fdef66c074386 2026-10-28
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 2026-10-28
- 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e 2026-10-28
- b4ad9b09c0119579e88b7627b9c48625934b1bd0a90fade337cd0d2281825513 2026-10-28
- 53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5 2026-10-28
- 9b6ba2ef41d4ba43c707f274f4b5c9b41ed41db6a99959821b983838495093cf 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
474.62 KB · 474,624 B
First seen
2026-10-28 00:30 · 20 hours ago
Last seen
2026-10-28 00:30 · 20 hours ago
Last analysis
2026-10-28 00:31 · 20 hours ago
Hashes
MD5
d6b49ebe62592843ab232a33d1e920f4
Sha1
ac1e23b16ba3d959263cbb7b0542fa82eb27cd28
Sha256
9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd
Sha384
15b748a6157a9703b43ac01dd4ea860a3d76b54a98e19e6d48863d99e4149c90badff96f9e429137907197eff2bb6440
Sha512
9c2e1edb68c6025f479711f9d47cf60bdc574d516d82fe9fa95d9e562907d1530f6ff6b274d789627688ba8b178943e520a5fde3f10d6fbe2b69a4d87f4d7a3d
SSDeep
6144:6tf+BLtABPDsthn9pXsBbwopWVo0kjafTiElI1D0REaIHkmbqFM:ZtlwRwopOo00p1DRaIEhFM
TLSH
04A4C58A1E9446B7D3AEE67490B3333D837BA8397BA7DF4D984A3D9917323488500753
Detection
PeID
Borland Delphi 7 - Nstd EP - ASL sign HQR data file
1 malicious · 11 files
EXEd6b49ebe62592843ab232a33d1e920f4XWorm
Structure
BINResources
BINRT_RCDATA
BINID:0000
BINID:0
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BINRT_ICON
BINID:0001
IMGID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
Shape
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
malicious
5 nodes
| Config. Field | Value |
|---|---|
| Mutex | fmhSxhuhuhuhuhuhuhu |
| Hosts | tcp.chuhuhuhuhuhuhu |
| Port | 5huhuhuhu |
| KEY | <12huhuhuhu |
| USBNM | <Xwhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialMutex
MUTEXmalicious
fmhSxhuhuhuhuhuhuhu
CnC
CNCmalicious
tcp.chuhuhuhuhuhuhu
Port
PORTmalicious
5huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 11 files
EXEd6b49ebe62592843ab232a33d1e920f4XWorm
Structure
BINResources
| Config. Field | Value |
|---|---|
| Mutex | fmhSxhuhuhuhuhuhuhu |
| Hosts | tcp.chuhuhuhuhuhuhu |
| Port | 5huhuhuhu |
| KEY | <12huhuhuhu |
| USBNM | <Xwhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialMutex
MUTEXmalicious
fmhSxhuhuhuhuhuhuhu
d6b49ebe62592843ab232a33d1e920f4 › Resources › RT_RCDATA › ID:0000 › ID:0
CnC
CNCmalicious
tcp.chuhuhuhuhuhuhu
d6b49ebe62592843ab232a33d1e920f4 › Resources › RT_RCDATA › ID:0000 › ID:0
Port
PORTmalicious
5huhuhuhu
d6b49ebe62592843ab232a33d1e920f4 › Resources › RT_RCDATA › ID:0000 › ID:0
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account