MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 18


Intelligence 18 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800
SHA3-384 hash: 97b06adc863ea53ec1e926850a5552414edd60ed5b7d6ba9b8f416523069f19114deb6d055d29105918cce3c4f878fed
SHA1 hash: ebdd198f3cc8250d279773cbbd85422c5a2ffdb6
MD5 hash: 14eac5d4385edf42ee4b30a738348c34
humanhash: thirteen-cola-arizona-venus
File name:SecuriteInfo.com.Win32.CrypterX-gen.1798.12497
Download: download sample
Signature XWorm
Create hunting rule
File size:1'120'256 bytes
First seen:2025-03-13 21:19:53 UTC
Last seen:2025-03-14 14:22:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:HugHDkJgxyAFQBsGNGHICvMh8RSEAbLvK9EkPHrh1YA00:/HDl13G7CvMh8RSBQHrw
Threatray 3'391 similar samples on MalwareBazaar
TLSH T1FD351221DB9ECE61CB6FC7B609D90F049B71F90297D387BB2DD891B5B6872442D08398
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe xworm

Intelligence

File Origin
# of uploads :
5
# of downloads :
447
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.CrypterX-gen.1798.12497
Verdict:
Malicious activity
Analysis date:
2025-03-13 21:20:49 UTC
Tags:
netreactor purecrypter remote xworm autorun-startup evasion snake keylogger stealer redline metastealer autorun-reg
Link:
https://app.any.run/tasks/d403a480-9914-4b2a-9079-3e093ffeff61

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d35da53962f1a6f471050e
Tags:
autorun virus shell micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Launching a process
Сreating synchronization primitives
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/67d34c140a7899f357950661/reports/199bf449-1845-4d9a-82bf-5a8c6eac2322/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e0d7a687-0e85-4c8b-ac86-7ce0d0e85933
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1637748
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Drops VBS files to the startup folder
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800/
Threat name:
Win32.Trojan.Seraph
Create hunting rule
Status:
Malicious
First seen:
2025-03-13 10:31:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ay4kxcrkrioh3dt7lnp5bmth3b22qkmkczxjfhgilpljcitfpaaa._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800
XWorm
6c7d556da59ccc293a71d4f44193c4b8f80f4a239f910c0068362203f852b310
XWorm
8977bc2c77c7b63e42bd2824ba65b3696c8910f42b75b1fcdcbd62b602081e99
XWorm
error
XWorm
fb3085cfc4959b833bd29c37bcc3499a8e8af1148ebde50959410273232b4177
XWorm
+ 3'381 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm collection discovery execution persistence rat trojan
Link:
https://tria.ge/reports/250313-z6tfgawmw5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Xworm
Xworm family
Malware Config
C2 Extraction:
204.10.161.147:7081
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b07b0f8e-1c45-47bc-83ff-3df733e0a227
Unpacked files
SH256 hash:
0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800
MD5 hash:
14eac5d4385edf42ee4b30a738348c34
SHA1 hash:
ebdd198f3cc8250d279773cbbd85422c5a2ffdb6
Link:
https://www.unpac.me/results/fdb1d5ca-de99-4506-b6cc-a3a00d8f18f0/
SH256 hash:
b49cca9c9c33101f01bb3b843d9dbea72e9f5f3c3bbcdfd32d4f938fa4f5e6cb
MD5 hash:
53d18b02ac063d75d88d62bd8c644f3f
SHA1 hash:
3536ac416ae74a93ef466de23999c724662f6366
Link:
https://www.unpac.me/results/fdb1d5ca-de99-4506-b6cc-a3a00d8f18f0/
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
Link:
https://www.unpac.me/results/fdb1d5ca-de99-4506-b6cc-a3a00d8f18f0/
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
Link:
https://www.unpac.me/results/fdb1d5ca-de99-4506-b6cc-a3a00d8f18f0/
SH256 hash:
c51872a2bccf065af090bd2bb067e771b8022a1234f3d2e51dd39785f4caf61d
MD5 hash:
1b397d4c39d246a58fe7c3dd0f3ad8f0
SHA1 hash:
4beae18bbcabeecf2fe1cf885c2ff65dc82fedb6
Link:
https://www.unpac.me/results/fdb1d5ca-de99-4506-b6cc-a3a00d8f18f0/
SH256 hash:
58018602d0ad31538a4c4926ec8b79cd9c4951bf0f1b4aafd07a785ac13d55be
MD5 hash:
f298510c3c663fe4ee5dfb82ea0f6e7e
SHA1 hash:
9a47a552e16c2e5b965c7c481cfc85618f35cc4a
Detections:
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
win_xworm_bytestring
Create hunting rule
win_mal_XWorm
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
MALWARE_Win_AsyncRAT
Create hunting rule
MALWARE_Win_XWorm
Create hunting rule
Link:
https://www.unpac.me/results/fdb1d5ca-de99-4506-b6cc-a3a00d8f18f0/
Parent samples :
0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800
4d693b4dd287f3aba462951d56f00aac4432794d3b489dfa93ffd17dbf40edc3
8e8b85ca1b4d5b6d629c758ec683a2530e54fc57e51d273e07e5d4f6f016dc72
d9a96e9b62e5b913df31e846590ce1e0443a43eeec2d0f091e60d82e44f7aa92
76b7a6c453c0e7ff462c2e4e5968707191841c1625086f23fb684d58ac5a40ec
54a728dbac9d9338a6ce84720d8a113c8c9305cdb407cc030fdc0f626802f10b
Malware family:
RedLine.F
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0638ab8a2a8a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments