MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28d6b3140a1935cd939e8a07266c43c0482e1fea80c65b7a49cf54356dcb58bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28d6b3140a1935cd939e8a07266c43c0482e1fea80c65b7a49cf54356dcb58bc
SHA3-384 hash: 6dbbc015e4599bd43be0d4c14e6828db9972d69448db75d94b1774ee16c7191da89f6329c99f13eea82406cefbf9fbba
SHA1 hash: 19ba5fbb1a73331f956f43d97502aaa7b54fc4e9
MD5 hash: 0d98c010a1071a79b2a984d63e50a01f
humanhash: potato-floor-white-orange
File name:LEPRFQAV04,pdf.001
Download: download sample
Signature XWorm
Create hunting rule
File size:38'655 bytes
First seen:2022-12-26 18:22:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:B6dpdxHhVYzMV4sgIo+aMdywBSXz1FRarr7GC4LbmhxCUiIaZjrjMPSR:opdxB2wVHo+aMRqdarfGexCUiIa9g6R
TLSH T1250302C49253DB2E9407AFB4719B0440FA69C4B9840963047F6B156DF868B6FCEF9D32
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter 0xToxin
Tags:001 PerceptionPoint rar scrubcrypt xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
IL IL
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:LEPRFQAV04,pdf.bat
File size:50'394 bytes
SHA256 hash: 04ce543c01a4bace549f6be2d77eb62567c7b65edbbaebc0d00d760425dcd578
MD5 hash: 7d8a84813d06c036c7df72e36d152fac
MIME type:text/x-msdos-batch
Signature XWorm
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
batch powershell
Link:
https://www.filescan.io/uploads/63a9e687a66e2eb29737736d/reports/119303ef-d5da-4478-b0f0-b8e7ab381eb5/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28d6b3140a1935cd939e8a07266c43c0482e1fea80c65b7a49cf54356dcb58bc/
Threat name:
Script-BAT.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2022-12-19 23:19:37 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
14 of 40 (35.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fdllgfakde243e46ridsm3cdybec4h7kqddfw6sjz5kdk3ollc6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28d6b3140a1935cd939e8a07266c43c0482e1fea80c65b7a49cf54356dcb58bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments