This sample is a 465 KB PE Executable identified by Malva.RE as XWorm / Vidar Stealer (rat, stealer). Static analysis extracted 19 embedded or derived files, a malware configuration (XWorm config.) and 1 command-and-control endpoint. It matches 23 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e
- MD5
- ff9f1ff45dfc61d2ad57f79e89491848
- Verdict
- Malicious
- File type
- PE Executable · 465 KB
- Family
- XWormVidar Stealer
- Category
- RAT, Stealer
- C2 (defanged)
ov1j9h5mhk[.]localto[.]net
Cite this report: https://app.malva.re/sha256/830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e
Related XWorm samples
- 1891b91cbe07657794700e6c8eab5ef7a4c64ed0fb8ab1e1f14fdef66c074386 2026-10-28
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 2026-10-28
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd 2026-10-28
- b4ad9b09c0119579e88b7627b9c48625934b1bd0a90fade337cd0d2281825513 2026-10-28
- 53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5 2026-10-28
- 9b6ba2ef41d4ba43c707f274f4b5c9b41ed41db6a99959821b983838495093cf 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
pe:exe>pe:rsrc>pe:exe>pe:rsrc>img
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
| Config. Field | Value |
|---|---|
| Mutex | 5a0yThuhuhuhuhuhuhu |
| Hosts | ov1j9hhuhuhuhuhuhuhu |
| Port | 4huhuhuhu |
| KEY | <12huhuhuhu |
| USBNM | <Xwhuhuhuhu |
| LoggerPath | %Phuhuhuhu |
| family | xhuhuhuhu |