MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1707efe35749f4477db431f041481a46dd48d22431e6846f4e13bff760dc4033. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 16


Intelligence 16 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1707efe35749f4477db431f041481a46dd48d22431e6846f4e13bff760dc4033
SHA3-384 hash: 901a775c50641255aff5c097adf4101aed55b9ca22751d332f70403ce6a6e2aefddbae4fed671c617d7b37c4ef30346b
SHA1 hash: ddc216572b1dc8d61f16639e74aceb7b5bf18bab
MD5 hash: 1c8c35c728f0ac7906153a4da2244a74
humanhash: pluto-high-hotel-ten
File name:chiara.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:1'406'359 bytes
First seen:2024-09-02 12:22:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8c16c795b57934183422be5f6df7d891 (36 x Mofksys, 18 x CryptOne, 6 x AveMariaRAT)
ssdeep 24576:PFOa3uDXTIGaPhEYzUzA0dCxs1TxICxVhfF/3Byqr7ghyCanq+hO5rrt:t6Djlabwz98ixHxVFdxyogwq+Y59
Threatray 9 similar samples on MalwareBazaar
TLSH T1FB55F10AFBA404F8E0B7D5B49C628A16F7757C0907B09E4F23A5161A2E77352BD7A313
TrID 42.6% (.EXE) Win32 Executable (generic) (4504/4/1)
19.4% (.ICL) Windows Icons Library (generic) (2059/9)
18.9% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon 74e4d4e4c4d4c0d4 (1 x Vidar, 1 x DiscordRAT, 1 x DicrordRAT)
Reporter lontze7
Tags:CryptOne DarkTortilla exe Mofksys xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
414
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
chiara.exe
Verdict:
Malicious activity
Analysis date:
2024-09-02 12:26:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e9902282-d7aa-430f-b921-155c68d54531

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Trojan.VBGeneric-6735875-0
Create hunting rule

Win.Trojan.Agent-1109049
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d5ae2a8e12b8124ac8f747
Tags:
Encryption Execution Generic Other Stealth Trojan
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the Windows subdirectories
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Searching for the window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for recently created files
Launching a service
Setting a single autorun event
Enabling a "Do not show hidden files" option
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm lolbin overlay packed setupapi shdocvw shell32 visual_basic
Link:
https://www.filescan.io/uploads/66d5ae29df54deddb84daabe/reports/7c228b32-8195-4e73-bca6-a17e275dd772/overview
Verdict:
Malicious
Labled as:
Gosys.B
Link:
https://www.hybrid-analysis.com/sample/1707efe35749f4477db431f041481a46dd48d22431e6846f4e13bff760dc4033
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cbe40f20-9db9-49e4-b984-fab138680a33
Result
Threat name:
CryptOne, DarkTortilla, Mofksys, XWorm
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1502918
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Detected CryptOne packer
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
PE file has a writeable .text section
Protects its processes via BreakOnTermination flag
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspect Svchost Activity
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected Generic Downloader
Yara detected Mofksys
Yara detected Telegram RAT
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1502918 Sample: chiara.exe Startdate: 02/09/2024 Architecture: WINDOWS Score: 100 99 mariona.duckdns.org 2->99 101 api.telegram.org 2->101 103 4 other IPs or domains 2->103 127 Suricata IDS alerts for network traffic 2->127 129 Found malware configuration 2->129 131 Malicious sample detected (through community Yara rule) 2->131 137 19 other signatures 2->137 11 chiara.exe 1 3 2->11         started        15 svchost.exe 2->15 injected 17 svchost.exe 1 1 2->17         started        20 6 other processes 2->20 signatures3 133 Uses dynamic DNS services 99->133 135 Uses the Telegram API (likely for C&C communication) 101->135 process4 dnsIp5 89 C:\Windows\Resources\Themes\icsys.icn.exe, MS-DOS 11->89 dropped 91 C:\Users\user\Desktop\chiara.exe, PE32+ 11->91 dropped 161 Drops executables to the windows directory (C:\Windows) and starts them 11->161 22 icsys.icn.exe 3 11->22         started        26 chiara.exe 10 11->26         started        163 Injects code into the Windows Explorer (explorer.exe) 15->163 28 consent.exe 15->28         started        30 explorer.exe 15->30         started        32 svchost.exe 15->32         started        97 127.0.0.1 unknown unknown 17->97 34 conhost.exe 20->34         started        36 conhost.exe 20->36         started        38 conhost.exe 20->38         started        file6 signatures7 process8 file9 83 C:\Windows\Resources\Themes\explorer.exe, MS-DOS 22->83 dropped 139 Antivirus detection for dropped file 22->139 141 Machine Learning detection for dropped file 22->141 143 Drops PE files with benign system names 22->143 40 explorer.exe 15 22->40         started        85 C:\Users\user\AppData\Local\...\shost.exe, PE32 26->85 dropped 45 shost.exe 26->45         started        145 Writes to foreign memory regions 28->145 signatures10 process11 dnsIp12 107 googlecode.l.googleusercontent.com 66.102.1.82, 49709, 49716, 49722 GOOGLEUS United States 40->107 109 74.125.133.82, 49710, 49720, 49723 GOOGLEUS United States 40->109 111 74.125.71.82, 49711, 49721, 49724 GOOGLEUS United States 40->111 87 C:\Windows\Resources\spoolsv.exe, MS-DOS 40->87 dropped 147 Antivirus detection for dropped file 40->147 149 System process connects to network (likely due to code injection or exploit) 40->149 151 Drops PE files with benign system names 40->151 47 spoolsv.exe 3 40->47         started        153 Machine Learning detection for dropped file 45->153 155 Writes to foreign memory regions 45->155 157 Allocates memory in foreign processes 45->157 159 2 other signatures 45->159 51 InstallUtil.exe 45->51         started        54 InstallUtil.exe 45->54         started        56 InstallUtil.exe 45->56         started        58 InstallUtil.exe 45->58         started        file13 signatures14 process15 dnsIp16 93 C:\Windows\Resources\svchost.exe, MS-DOS 47->93 dropped 113 Antivirus detection for dropped file 47->113 115 Machine Learning detection for dropped file 47->115 117 Drops PE files with benign system names 47->117 60 svchost.exe 2 2 47->60         started        105 api.telegram.org 149.154.167.220, 443, 49765 TELEGRAMRU United Kingdom 51->105 95 C:\Users\...\Windows Logon Application.exe, PE32 51->95 dropped 119 Protects its processes via BreakOnTermination flag 51->119 121 Adds a directory exclusion to Windows Defender 51->121 63 powershell.exe 51->63         started        65 powershell.exe 51->65         started        67 powershell.exe 51->67         started        69 2 other processes 51->69 123 Bypasses PowerShell execution policy 54->123 125 Uses schtasks.exe or at.exe to add and modify task schedules 54->125 file17 signatures18 process19 signatures20 165 Antivirus detection for dropped file 60->165 167 Detected CryptOne packer 60->167 169 Machine Learning detection for dropped file 60->169 171 Drops executables to the windows directory (C:\Windows) and starts them 60->171 71 spoolsv.exe 60->71         started        173 Loading BitLocker PowerShell Module 63->173 73 conhost.exe 63->73         started        75 conhost.exe 65->75         started        77 conhost.exe 67->77         started        79 conhost.exe 69->79         started        81 conhost.exe 69->81         started        process21
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1707efe35749f4477db431f041481a46dd48d22431e6846f4e13bff760dc4033
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1707efe35749f4477db431f041481a46dd48d22431e6846f4e13bff760dc4033/
Threat name:
Win32.Trojan.Golsys
Create hunting rule
Status:
Malicious
First seen:
2024-09-02 12:23:07 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c4d67y2xjh2eo7nughyecsa2i3ourureghtii32oco77oyg4iazq._file
Verdict:
malicious
Similar samples:
52de83987941b92875cecdd1661cc2757eae4f02ef564fd2e147d06eb9d8ab44
XWorm
575901f83294547395d2a53d741ecc756906c62a0d7e942890a23c833e0593de
XWorm
b23274e47a003476681da8925f2c15ff1c7ef988cabf76dbf1e5799a914a3ab1
XWorm
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd
XWorm
b7974dfd10dea3d89979b441677202d9be7d5c9eab26df59b9d7afe27f56a290
XWorm
d4771dbf9066fec456aba9736643c4f5b9578fdecb4a475e6aff737323e37fe4
XWorm
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery evasion execution persistence rat trojan
Link:
https://tria.ge/reports/240902-pkfx5szdrq/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Modifies visiblity of hidden/system files in Explorer
Xworm
Malware Config
C2 Extraction:
mariona.duckdns.org:6666
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f20d30ce-478a-4924-8ac5-748693c62421
Unpacked files
SH256 hash:
64aa0b4255c7355dde459228494e52fa4eafbede311b393585faf4dc05eabfbe
MD5 hash:
7f2742f64322b2d1f9d5ebb7aa83e49a
SHA1 hash:
988a9c28223da57de358ff5227b0a395cdc9d4bc
Link:
https://www.unpac.me/results/57dd4b06-5602-4525-ad66-d41b206178a2/
SH256 hash:
690e59a6dc059fc777bbcfb97255330425b123fe64c8ecbaf690bf04f211c8bf
MD5 hash:
aa08af3a178a43a85862414b428467ed
SHA1 hash:
38258408606928b1a08f5f3f3dd1ce825fe6bbda
Link:
https://www.unpac.me/results/57dd4b06-5602-4525-ad66-d41b206178a2/
SH256 hash:
1707efe35749f4477db431f041481a46dd48d22431e6846f4e13bff760dc4033
MD5 hash:
1c8c35c728f0ac7906153a4da2244a74
SHA1 hash:
ddc216572b1dc8d61f16639e74aceb7b5bf18bab
Detections:
SUSP_Imphash_Mar23_2
Create hunting rule
Link:
https://www.unpac.me/results/57dd4b06-5602-4525-ad66-d41b206178a2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1707efe35749/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1707efe35749f4477db431f041481a46dd48d22431e6846f4e13bff760dc4033

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Nimplant_PE
Create hunting rule
Author:daniyyell
Description:Detects malicious nimplant variant PE malware.
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
Rule name:Windows_Generic_Threat_7526f106
Create hunting rule
Author:Elastic Security
Rule name:Windows_Generic_Threat_cbe3313a
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XWorm

Executable exe 1707efe35749f4477db431f041481a46dd48d22431e6846f4e13bff760dc4033

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3153137/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaCopyBytes
MSVBVM60.DLL::__vbaSetSystemError
MSVBVM60.DLL::__vbaExitProc
MSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaFileOpen

Comments