MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 057dbd5bc383ce05a385313edfa5e5e46c2ac152832afff27965ee57aa25dffc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 057dbd5bc383ce05a385313edfa5e5e46c2ac152832afff27965ee57aa25dffc
SHA3-384 hash: 45dcac99e0f18a0286c0b1ec112e5df385add6c3810da19b4eaf637a4c84e624145acbdb931237a2722a49086fce89de
SHA1 hash: de57f5073fa26014edf65cb37caf86d645e8690d
MD5 hash: 626b2c878f97479b3abd26bf1158d6be
humanhash: beryllium-gee-kilo-arkansas
File name:Update.ps1
Download: download sample
Signature XWorm
Create hunting rule
File size:683'597 bytes
First seen:2025-05-25 12:27:34 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12288:YXYAJjccx/fnQKKo5aS6ARbsw3lVYjbT6fQ5vGg6SBoUlrEqFwVv:Y7ZT//QPo59YwKjA2+SBTGqFwVv
Threatray 259 similar samples on MalwareBazaar
TLSH T178E423114FBDAC798929C128A62FDF1C59E1079C103DA69E50CA72D3F29E305AF578F2
Magika powershell
Reporter 01Xyris
Tags:ps1 xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68330e7d44c3881e854d2b41
Tags:
ransomware emotet sage remo
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 obfuscated
Link:
https://www.filescan.io/uploads/68330cf858764b44c678cbac/reports/ddbcca6e-3970-4789-b489-d85c4110013a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/057dbd5bc383ce05a385313edfa5e5e46c2ac152832afff27965ee57aa25dffc
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1698766
Signature
AI detected malicious Powershell script
Compiles code for process injection (via .Net compiler)
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Sigma detected: Dot net compiler compiles file from suspicious location
Writes to foreign memory regions
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/057dbd5bc383ce05a385313edfa5e5e46c2ac152832afff27965ee57aa25dffc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/057dbd5bc383ce05a385313edfa5e5e46c2ac152832afff27965ee57aa25dffc/
Threat name:
Script-PowerShell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-05-25 12:28:38 UTC
File Type:
Text
AV detection:
5 of 38 (13.16%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=av632w6dqphali4fge7n7jpf4rwcvqksqmvp74tzmxxfpkrf376a._file
Verdict:
malicious
Label(s):
donut_injector
Create hunting rule
xworm
Create hunting rule
Similar samples:
057dbd5bc383ce05a385313edfa5e5e46c2ac152832afff27965ee57aa25dffc
XWorm
12c2b8ca8d4b2d8436acbbf3d301ed12c08af88fda70a6b2755dc3051e5212f8
XWorm
4364d77092f2f40968b3aa06fe458a88f319e844f60902d28ef4a4752da21538
XWorm
4b7a85411716775d966284e879a6bda87feade4c9f40cb94ade6e217793e8a84
XWorm
8a10eec1f7fd5b66ad2095eaa8481e9bfd6669033af3233c4bfeaf5a1de9ff3a
XWorm
b85e7dc9e45339bcaa054174c0413fc318fff91b845a2c3c7d09c4fa657dbb72
XWorm
bb032095d58c9fe40f6e0faee14a196e76ba4a2e2fc0240dfaccbb4afa926d69
XWorm
e3ef1c4bd2a11cfbf55001d9581f3c10b881d6561bda19dab5b1a96f77c4fa89
XWorm
error
XWorm
+ 249 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:xworm execution loader rat trojan
Link:
https://tria.ge/reports/250525-pnlb2aymx8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Detects DonutLoader
DonutLoader
Donutloader family
Xworm
Xworm family
Malware Config
C2 Extraction:
epicskillforge.com:7078
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/057dbd5bc383ce05a385313edfa5e5e46c2ac152832afff27965ee57aa25dffc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
Xworm

Comments