MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 19


Intelligence 19 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f
SHA3-384 hash: 5e79efbbb7122381fffa5c58ff7893dae63a2ebd92c3a123bfa248db5d3279a4ac7065f2b34f40a203e805dad28abfa7
SHA1 hash: 66aa4ffd9962eb6c12d8d9816728d5553a7c97f7
MD5 hash: dcbbcbc44376a4d97cfe07b915c81071
humanhash: tennessee-social-happy-carpet
File name:Contract3550925.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:567'808 bytes
First seen:2025-09-16 05:10:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'604 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:imxBVn0V6gtShqZcjchi0pEzMqOaTHjxOH2oplh1hCF7sy:ioB5y6ymqZmx0pkMcTH0H9p31sVB
Threatray 1'525 similar samples on MalwareBazaar
TLSH T1DDC4F165339BEC03D85E1BF00AB1D7B45239AE8CBA10C3579FFBACEBB8657102455192
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe xworm


Avatar
abuse_ch
XWorm C2:
91.92.241.52:1012

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.92.241.52:1012 https://threatfox.abuse.ch/ioc/1590462/

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Contract3550925.exe
Verdict:
Malicious activity
Analysis date:
2025-09-16 05:13:18 UTC
Tags:
auto-startup remote xworm stealer auto generic
Link:
https://app.any.run/tasks/5c02c49c-4a49-4c3a-ae02-8c5f456788bf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/27642/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c8f157d49ea3f1e4b64c11
Tags:
autorun keylog shell spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Setting a global event handler for the keyboard
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bitmap lolbin msbuild njrat njrat obfuscated packed packed rat reconnaissance regsvcs rezer0 roboski schtasks stego vbc vbnet
Link:
https://www.filescan.io/uploads/68c8f176dbc6f5a29c46e43f/reports/992aef1f-7cee-44d2-9a63-e73c45a2d0b7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-16T01:05:00Z UTC
Last seen:
2025-09-16T01:05:00Z UTC
Hits:
~1000
Detections:
Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb Backdoor.MSIL.XWorm.c VHO:Backdoor.Win32.Agent.gen PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Taskun.gen Backdoor.Agent.TCP.C&C Trojan.MSIL.Taskun.sb
Link:
https://opentip.kaspersky.com/008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cfcc046a-d0f6-45ba-bd2b-446a593d07c1
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1778223
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected AntiVM3
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1778223 Sample: Contract3550925.exe Startdate: 16/09/2025 Architecture: WINDOWS Score: 100 44 Suricata IDS alerts for network traffic 2->44 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 11 other signatures 2->50 8 Contract3550925.exe 3 2->8         started        process3 file4 34 C:\Users\user\...\Contract3550925.exe.log, ASCII 8->34 dropped 52 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->52 54 Bypasses PowerShell execution policy 8->54 56 Adds a directory exclusion to Windows Defender 8->56 58 Injects a PE file into a foreign processes 8->58 12 Contract3550925.exe 1 7 8->12         started        signatures5 process6 dnsIp7 40 91.92.241.52, 1012, 49719 THEZONEBG Bulgaria 12->40 36 C:\Users\user\AppData\Roaming\bin.exe, PE32 12->36 dropped 38 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 12->38 dropped 60 Protects its processes via BreakOnTermination flag 12->60 62 Tries to harvest and steal browser information (history, passwords, etc) 12->62 64 Adds a directory exclusion to Windows Defender 12->64 17 powershell.exe 23 12->17         started        20 powershell.exe 23 12->20         started        22 powershell.exe 23 12->22         started        24 powershell.exe 12->24         started        file8 signatures9 process10 signatures11 42 Loading BitLocker PowerShell Module 17->42 26 conhost.exe 17->26         started        28 conhost.exe 20->28         started        30 conhost.exe 22->30         started        32 conhost.exe 24->32         started        process12
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.25 Win 32 Exe x86
Link:
https://app.malva.re/file/dcbbcbc44376a4d97cfe07b915c81071
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-09-16 05:11:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=achjfmpkck2twbstccl2g2svqlqik3gv6a6mdcdgdpka5km5vypq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
1bfbb76b330000d77b2265ccec0624c973c8e368838798d4e7a20fd1d4ec3cb1
XWorm
5cb3bf5f0c0abd19e74b72ed4560f7a5295db8e0d2cbb705976d1dd8e1f93fe0
XWorm
a0a8a753c1523bf8412ae06022cbc3858e683383510da9e3c4a042595dae90df
XWorm
d248a0c9b30b0ae7ba91096d8106ca1b97b706a4d10e3921caeab6e9031bd565
XWorm
e05be2a9868239b747273edcf15dd8b418edcf1794bc72b26e5ccac2e1a2fa4b
XWorm
e1c15c99454facc621a684184061f6ec4aada15066a792f24a35687d791b1549
XWorm
error
XWorm
+ 1'515 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm collection discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/250916-fvdq4afn7x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Drops startup file
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9dc70141-f011-425a-be9e-4948c4d2d8ef
Unpacked files
SH256 hash:
008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f
MD5 hash:
dcbbcbc44376a4d97cfe07b915c81071
SHA1 hash:
66aa4ffd9962eb6c12d8d9816728d5553a7c97f7
Link:
https://www.unpac.me/results/f0aec764-eecc-49a3-8192-0fdb19df7dd5/
SH256 hash:
1041b538ccbc7d66e59247ef7551cde9b6c282843541585e9190a8e2e3943b12
MD5 hash:
e870d1e8f3791ccc141f85f40fd2972b
SHA1 hash:
150919ee289cffa6feb40ab8261f620dd7e26aac
Link:
https://www.unpac.me/results/f0aec764-eecc-49a3-8192-0fdb19df7dd5/
SH256 hash:
a4f861741f9b3787fd3fc715e3a51c528c3dffb0489092820abac5295f1d0852
MD5 hash:
943816de862d1152769381d61418f6c8
SHA1 hash:
2959119b9fd19b29d48e509f844e8434eaf096b6
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f0aec764-eecc-49a3-8192-0fdb19df7dd5/
SH256 hash:
97b628e278193ae07cc00398e0b5bf7cad316f6db5ba10ce1ee41745147415d2
MD5 hash:
ea684b94afeddd11720eade34f1d5d60
SHA1 hash:
b5ee6f4282c5fb708b5d95ec3f2d3807a9e9f6df
Link:
https://www.unpac.me/results/f0aec764-eecc-49a3-8192-0fdb19df7dd5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/008e92b1ea12/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/008e92b1ea12b53b06531097a36a5582e0856cd5f03cc188661bd40ea99dae1f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Trojan_XWorm_b7d6eaa8
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27642/

Comments