MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 18


Intelligence 18 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9
SHA3-384 hash: 2c12431d19fa77b828f66e69c64a059f21f17ec5e2e66fb1c465bd816c84ef2535f5e554023526963b4729f360a2464a
SHA1 hash: ba240969db2c865063a75f8186f2fc83860d52ae
MD5 hash: 1851dc48b25b34d01dce54dd74e1a7f0
humanhash: crazy-march-zebra-cola
File name:DriverMonitor.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:237'568 bytes
First seen:2025-08-13 21:10:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 3072:ZgtSlj8czn5FQ7DgOsctA/qFQBEHBAnpK37nXN8t005Q5cvPsE74tyJhbSKsIS0g:0Sr5FI8Od0q98PnvPzkgm5jwzXR9
Threatray 80 similar samples on MalwareBazaar
TLSH T11B346C112BF8C92BEBBF5BB5E0B112102774E10BA561EB4A388C25F95B233415D527BF
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe xworm


Avatar
abuse_ch
XWorm C2:
181.41.200.38:6677

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
181.41.200.38:6677 https://threatfox.abuse.ch/ioc/1568293/

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DriverMonitor.exe
Verdict:
Malicious activity
Analysis date:
2025-08-13 20:55:36 UTC
Tags:
xworm
Link:
https://app.any.run/tasks/7dc89beb-c424-4182-9cd9-5224b4a63786

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/21222/
Detection(s):
Win.Packed.Msilmamut-10007182-0
Create hunting rule

Win.Dropper.LokiBot-10010685-0
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689cff4d31e468d937249dda
Tags:
virus shell spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a window
Searching for the window
Adding an access-denied ACE
DNS request
Connection attempt
Setting a global event handler for the keyboard
Creating a file in the mass storage device
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
cmstp control evasive evasive fingerprint lolbin obfuscated remote vbnet
Link:
https://www.filescan.io/uploads/689cff532fbe0788fb1f5d64/reports/f4725154-5dd9-418d-9f3e-ccf20b98586e/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8cf93631-93e2-48cb-9446-85e1203d8377
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1756417
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Uses dynamic DNS services
Yara detected UAC Bypass using CMSTP
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1756417 Sample: DriverMonitor.exe Startdate: 13/08/2025 Architecture: WINDOWS Score: 100 30 zulo1708.ddns.net 2->30 36 Suricata IDS alerts for network traffic 2->36 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 44 11 other signatures 2->44 8 DriverMonitor.exe 2 2->8         started        12 DriverMonitor.exe 1 2->12         started        14 DriverMonitor.exe 2 2->14         started        signatures3 42 Uses dynamic DNS services 30->42 process4 dnsIp5 26 C:\Users\user\AppData\...\DriverMonitor.exe, PE32 8->26 dropped 46 Bypasses PowerShell execution policy 8->46 48 Adds a directory exclusion to Windows Defender 8->48 17 powershell.exe 23 8->17         started        20 powershell.exe 22 8->20         started        28 C:\Users\user\...\DriverMonitor.exe.log, CSV 12->28 dropped 50 Antivirus detection for dropped file 12->50 52 Multi AV Scanner detection for dropped file 12->52 54 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->54 32 zulo1708.ddns.net 181.41.200.38, 49695, 6677 ASDETUKhttpwwwheficedcomGB Chile 14->32 56 Protects its processes via BreakOnTermination flag 14->56 file6 signatures7 process8 signatures9 34 Loading BitLocker PowerShell Module 17->34 22 conhost.exe 17->22         started        24 conhost.exe 20->24         started        process10
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9
Verdict:
inconclusive
YARA:
7 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.23 Win 32 Exe x86
Link:
https://app.malva.re/file/1851dc48b25b34d01dce54dd74e1a7f0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-08-13 07:46:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
31 of 37 (83.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uipkhpqr3k4p6acwmqi3zja6u3ddllbj5vy3zkbhjwswaodxaheq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9
XWorm
d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3
XWorm
e327efd4243601327f2dab0e3d9a5ef0426edaeb90f78964a6f699d49ff1bfa3
XWorm
eaa6b8a5b290c65fde4b9529864704ec9e562156c933ecb93a9d132d18fad386
XWorm
error
XWorm
f258e1faa4cbb6c3976d2e99e55f9a97da51d197f9fd9ba58553c2dd2541999e
XWorm
+ 70 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm execution persistence ransomware rat trojan
Link:
https://tria.ge/reports/250813-z1afeavkv7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Verdict:
Malicious
Tags:
Win.Packed.Msilmamut-10007182-0
YARA:
n/a
Link:
https://app.threat.zone/submission/09d51d3f-dbf5-4131-81c9-53480c51d000
Unpacked files
SH256 hash:
a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9
MD5 hash:
1851dc48b25b34d01dce54dd74e1a7f0
SHA1 hash:
ba240969db2c865063a75f8186f2fc83860d52ae
Link:
https://www.unpac.me/results/94f2cbff-08e2-4ee7-aeae-d4bb2307bc27/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a21ea3be11da/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a21ea3be11dab8ff00566411bca41ea6c635ac29ed71bca8274da560387701c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/21222/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments