MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d217b9013c1578eb733e5a1c33813c0154eedf0c0a74f1176c96dedf95f57af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d217b9013c1578eb733e5a1c33813c0154eedf0c0a74f1176c96dedf95f57af
SHA3-384 hash: 44664d407ed60721c0dd58bb77fc2493b0e4f8fea37f467fe26318ba9900e149cd38e575f823b7d868b28538d854c2ca
SHA1 hash: 08e40f8bfc720ecd16d6335f45933c7ba7a0e921
MD5 hash: b9db8e2e89dd73a495b96bf800732493
humanhash: social-uranus-magazine-idaho
File name:Demande_de_devis_18320053868910_M3-SA.bat
Download: download sample
Signature XWorm
Create hunting rule
File size:7'795 bytes
First seen:2025-09-25 07:46:57 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 192:MkY7qQqceAKpqQzdq5qQg7gjlgjtqKq5dqASgqBSraqdqUqj0qnIqbAGqOrHq4Y7:W7qQqdlpqQzdq5qQg7g5gxqKq5dqiq0F
Threatray 2'429 similar samples on MalwareBazaar
TLSH T15EF1B1B024EB7E526B75E7AB4516C97A03128A9707AFE3981635198C06A4D00FDF6FC8
Magika txt
Reporter abuse_ch
Tags:bat xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Demande_de_devis_18320053868910_M3-SA.bat
Verdict:
Malicious activity
Analysis date:
2025-09-25 07:50:39 UTC
Tags:
payload loader reverseloader susp-powershell
Link:
https://app.any.run/tasks/fcfdac0d-054e-40c5-a930-2f4eb852d940

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28929/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d54d5d1e4783989051ee7a
Tags:
obfuscate xtreme shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 evasive obfuscated obfuscated powershell
Link:
https://www.filescan.io/uploads/68d4f4a5674d5fd6aa0c2520/reports/4da462dd-54b5-4f90-ad37-1cf0afd8acf1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0d217b9013c1578eb733e5a1c33813c0154eedf0c0a74f1176c96dedf95f57af
Verdict:
Unknown
File Type:
text
First seen:
2025-09-23T19:12:00Z UTC
Last seen:
2025-09-23T19:12:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0d217b9013c1578eb733e5a1c33813c0154eedf0c0a74f1176c96dedf95f57af/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1783779
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found malware configuration
Found Tor onion address
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1783779 Sample: Demande_de_devis_1832005386... Startdate: 25/09/2025 Architecture: WINDOWS Score: 100 28 osonsgroup.com 2->28 30 masqingtestformat.gleeze.com 2->30 32 archive.org 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 11 other signatures 2->48 8 cmd.exe 1 2->8         started        11 svchost.exe 1 1 2->11         started        signatures3 process4 dnsIp5 52 Suspicious powershell command line found 8->52 54 Bypasses PowerShell execution policy 8->54 14 powershell.exe 14 15 8->14         started        18 conhost.exe 8->18         started        36 127.0.0.1 unknown unknown 11->36 signatures6 process7 dnsIp8 38 osonsgroup.com 91.234.194.20, 443, 49699 RMI-FITECHFR France 14->38 40 archive.org 207.241.224.2, 49698, 80 INTERNET-ARCHIVEUS United States 14->40 56 Found Tor onion address 14->56 58 Writes to foreign memory regions 14->58 60 Suspicious execution chain found 14->60 62 Injects a PE file into a foreign processes 14->62 20 RegAsm.exe 14->20         started        23 RegAsm.exe 2 14->23         started        26 conhost.exe 14->26         started        signatures9 process10 dnsIp11 50 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->50 34 masqingtestformat.gleeze.com 172.245.112.200, 49702, 9870 AS-COLOCROSSINGUS United States 23->34 signatures12
Score:
3%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/0d217b9013c1578eb733e5a1c33813c0154eedf0c0a74f1176c96dedf95f57af
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d217b9013c1578eb733e5a1c33813c0154eedf0c0a74f1176c96dedf95f57af/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2025-09-25 07:51:36 UTC
File Type:
Text
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=buqxxeatyfly5nzt4wq4goatyaku53pqyctu6elwzfw636k7k6xq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
0cdbc8796b5a5adba8b361c2b13626b03c4b25975244bec36b6acf0dcde65352
XWorm
3b39da6b761aebfac6324138212fd5a6eeb89a50ef1e7b8f8a813c07ac920062
XWorm
41cdbafba89bad77d1784458e5c226eb405ca9f46bb65a38031c48a97e6eef84
XWorm
45ba32fcb65201e7cae3d05f77178e08fd41380624edd777e355c63ac1d126b7
XWorm
699b91f69cd0d059794175c55675ad931a2eaa18cb713523265429da6b021633
XWorm
error
XWorm
f03cc966d2abcece5e21a8c90cb2ae5472971202377c59187821f3188012d992
XWorm
+ 2'419 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/250925-jpzcdstvdx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
http://archive.org/download/optimized_MSI_PRO_with_b64/optimized_MSI_PRO_with_b64.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d217b9013c1578eb733e5a1c33813c0154eedf0c0a74f1176c96dedf95f57af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/28929/

Comments