MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927
SHA3-384 hash: f6d1d2f7cd53c5270c5662a0d62a2e387c2b1fa9e02c780983ed58ce3eb175f1614299a66abd1dbc1039e485a8953291
SHA1 hash: 07575f079f3f084151a349526cb39027b8503d04
MD5 hash: d82abb7a5a281f9dc56ea31d2c544254
humanhash: michigan-cup-thirteen-angel
File name:Angebotsanfrage_87000341280004539_Metallbau_Figge.bat
Download: download sample
Signature XWorm
Create hunting rule
File size:11'011 bytes
First seen:2025-10-22 06:11:25 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 96:RcHyTUu8rqiPOEKNe/xHee5BzBs8EFlfZXWDd:RNUu8eW/fce5s8E6d
Threatray 2'537 similar samples on MalwareBazaar
TLSH T17E32DC50150EE8C51DBB311D8C50CD8FAA18B0DA9F2998AF31D4434F653EA1DC8DF9AE
Magika vba
Reporter lowmal3
Tags:bat xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Angebotsanfrage_87000341280004539_Metallbau_Figge.bat
Verdict:
Malicious activity
Analysis date:
2025-10-22 06:17:58 UTC
Tags:
loader reverseloader payload susp-powershell xworm
Link:
https://app.any.run/tasks/091ea582-afbb-41d3-b0f2-32e5190d08f5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33696/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f87621ad6ce0f5ad409393
Tags:
obfuscate xtreme shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 batch evasive obfuscated obfuscated overlay powershell
Link:
https://www.filescan.io/uploads/68f8768cc85c5c569731cc4b/reports/ba1f77e8-59b9-4308-8579-2275556f28d3/overview
Verdict:
Malicious
Labled as:
TrojanDownloader/BAT.Netloader
Link:
https://www.hybrid-analysis.com/sample/0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927
Verdict:
Clean
File Type:
text
First seen:
2025-10-21T21:12:00Z UTC
Last seen:
2025-10-23T01:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1799577
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found malware configuration
Found Tor onion address
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1799577 Sample: Angebotsanfrage_87000341280... Startdate: 22/10/2025 Architecture: WINDOWS Score: 100 25 propracontrolly.duckdns.org 2->25 27 ia601007.us.archive.org 2->27 29 2 other IPs or domains 2->29 39 Suricata IDS alerts for network traffic 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 47 11 other signatures 2->47 8 cmd.exe 1 2->8         started        signatures3 45 Uses dynamic DNS services 25->45 process4 signatures5 49 Suspicious powershell command line found 8->49 51 Bypasses PowerShell execution policy 8->51 11 powershell.exe 14 15 8->11         started        15 conhost.exe 8->15         started        process6 dnsIp7 31 ia601007.us.archive.org 207.241.227.37, 49686, 80 INTERNET-ARCHIVEUS United States 11->31 33 osonsgroup.com 91.234.194.20, 443, 49687 RMI-FITECHFR France 11->33 35 archive.org 207.241.224.2, 49685, 80 INTERNET-ARCHIVEUS United States 11->35 53 Found Tor onion address 11->53 55 Writes to foreign memory regions 11->55 57 Injects a PE file into a foreign processes 11->57 17 CasPol.exe 4 11->17         started        21 conhost.exe 11->21         started        signatures8 process9 dnsIp10 23 propracontrolly.duckdns.org 172.245.112.200, 49689, 9870 AS-COLOCROSSINGUS United States 17->23 37 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->37 signatures11
Score:
10%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2025-10-22 06:16:12 UTC
File Type:
Text
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bst45cfso3hg5ot3mox4spoac5wauwfrq2ijpueqe4jzapmcvetq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
220e5c0ee3fec540448955bb9f2c5324c0a01d65323b48b00caed7a45d5df6ef
XWorm
3a444e7690f35fee4be070d0656bc7f0adab9bdcec798d5af27fc3c93e08f611
XWorm
3b39da6b761aebfac6324138212fd5a6eeb89a50ef1e7b8f8a813c07ac920062
XWorm
41cdbafba89bad77d1784458e5c226eb405ca9f46bb65a38031c48a97e6eef84
XWorm
61c99aca559a36c194dac72b7871716b26722cbcc3510e77f9354d942f0cf021
XWorm
732975f6429f6127a1927f1a5ebeb2a28b2d64e8b7b2c22df37708ac165074cc
XWorm
error
XWorm
+ 2'527 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution rat trojan
Link:
https://tria.ge/reports/251022-gzrzys1lbp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
participationcontrol.duckdns.org:9870
propracontrolly.duckdns.org:9870
masterforshizllett.giize.com :9870
Dropper Extraction:
http://archive.org/download/msi-pro-with-b-64_20251021_1736/MSI_PRO_with_b64.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Batch (bat) bat 0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/33696/

Comments