MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 187b80c4e227f46d3dd7b9d47ea704bfe657693e16c724cbc2fc8b98fa9b0bcd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 11

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	187b80c4e227f46d3dd7b9d47ea704bfe657693e16c724cbc2fc8b98fa9b0bcd
SHA3-384 hash:	b4d47a3a070bf5fd0e78f22881723da449a1e2660712b6ed5b354853a5825f7a724b82cc3c9f45e24ec3da29c91e4788
SHA1 hash:	e0db5541a041a430ef3e6ac5d18aff1914c0be52
MD5 hash:	c330b6240042bdf9c4a98696347addaf
humanhash:	lithium-uncle-table-mike
File name:	r8qjpc.ps1
Download:	download sample
Signature	XWorm Create hunting rule
File size:	17'175 bytes
First seen:	2025-08-12 07:29:55 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	192:XW80Tg0mWBvYGMJXvLGsMYyjrf1IVH/rmVptYqqCyURbDgCVeyZx2owl0rfkt5b6:XW80E0mWBvk7GOtyVimmFy
Threatray	38 similar samples on MalwareBazaar
TLSH	T1B77277143A051A0952B367B9FEEB6148FE670837916C0824B5BC96C4BFF2D20D5A5FCA
Magika	powershell
Reporter	abuse_ch
Tags:	ps1 xworm

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Heur.BZC.PZQ.Pantera.181.2DD7E306.17054.31326.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689aedb1c633abe3908e2df5

Tags:

virus shell hype

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/689aedfe9ef4d2ff7cf7d9f2/reports/0c4ce616-40bf-49f7-ba4e-9f5a5fd2a3c1/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/187b80c4e227f46d3dd7b9d47ea704bfe657693e16c724cbc2fc8b98fa9b0bcd

Result

Threat name:

AsyncRAT, XWorm

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1755130

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Protects its processes via BreakOnTermination flag

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AsyncRAT

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/187b80c4e227f46d3dd7b9d47ea704bfe657693e16c724cbc2fc8b98fa9b0bcd

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

PowerShell

Link:

https://app.malva.re/file/c330b6240042bdf9c4a98696347addaf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/187b80c4e227f46d3dd7b9d47ea704bfe657693e16c724cbc2fc8b98fa9b0bcd/

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/187b80c4e227f46d3dd7b9d47ea704bfe657693e16c724cbc2fc8b98fa9b0bcd

Threat name:

Script-PowerShell.Spyware.AsyncRAT

Status:

Malicious

First seen:

2025-08-11 20:49:31 UTC

File Type:

Text (PowerShell)

AV detection:

8 of 24 (33.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=db5ybrhce72g2poxxhkh5jyex7tfo2j6c3dsjs6c7sfzr6u3bpgq._file

Verdict:

malicious

Label(s):

xworm

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm execution rat trojan

Link:

https://tria.ge/reports/250812-jc2a8awpz4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Blocklisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

2.tcp.eu.ngrok.io:16552

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/187b80c4e227f46d3dd7b9d47ea704bfe657693e16c724cbc2fc8b98fa9b0bcd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	rhadamanthys_ps1_v1 Create hunting rule
Author:	RandomMalware

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XWorm

ps1 187b80c4e227f46d3dd7b9d47ea704bfe657693e16c724cbc2fc8b98fa9b0bcd

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3600894/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample