MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2be2f990dc0fa1f4f3f485742a840aaed551fcbb6fe2cc07e8aa183bdc011024. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 13
| SHA256 hash: | 2be2f990dc0fa1f4f3f485742a840aaed551fcbb6fe2cc07e8aa183bdc011024 |
|---|---|
| SHA3-384 hash: | ff3c533d23acee8989ee0808ea624e81646c81eb3b8244229d392ab08ef8e5983495b8f6f011da6d0bc1a2a267c87f97 |
| SHA1 hash: | c03db3bff0b8b8e639bd017cf2aa50bb6ef0089d |
| MD5 hash: | eb038dd6b07d8458fea6f6035b29e1ba |
| humanhash: | chicken-yankee-maryland-mexico |
| File name: | SCANDOCMENT.MSI |
| Download: | download sample |
| Signature | XWorm |
| File size: | 352'256 bytes |
| First seen: | 2026-09-22 06:13:21 UTC |
| Last seen: | Never |
| File type: |  msi |
| MIME type: | application/x-msi |
| ssdeep | 6144:S8G6Ug4yDf0/Bu08rKS932ZH1olrr0D+0xKZdQP7tqTxF3K4U6he1:SLUHf+DmpodTgTxFB9 |
| TLSH | T10274231172B2DA27C91303379B9B8BA69F772C718B4709682254FA7C2DBB0744A17CF5 |
| TrID | 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1) |
| Magika | msi |
| Reporter |  lowmal3 |
| Tags: | msi xworm |
Intelligence
File Origin
# of uploads :
1
# of downloads :
66
Origin country :
DEVendor Threat Intelligence
Malware configuration found for:
MSI
Details
Detection:
XWorm
Detection(s):
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
anti-debug CAB installer installer obfuscated packed wix
Verdict:
Suspicious
Labled as:
Generik.RDZTMG trojan
Verdict:
Clean
File Type:
msi
First seen:
2026-09-21T11:09:00Z UTC
Last seen:
2026-09-22T08:37:00Z UTC
Hits:
~10
Result
Threat name:
DonutLoader, XWorm
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Drops PE files to the document folder of the user
Found malware configuration
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses whoami command line tool to query computer and username
Yara detected DonutLoader
Yara detected Lua decrypt and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Score:
70%
Verdict:
Susipicious
File Type:
ARCHIVE
Verdict:
Malware
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:LZX Executable Office Document PE (Portable Executable) PE File Layout T1059.005
Threat name:
Win32.Trojan.Ravartar
Status:
Malicious
First seen:
2026-09-21 12:56:57 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
11 of 24 (45.83%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
XWorm
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xworm collection defense_evasion discovery execution persistence privilege_escalation ransomware rat spyware stealer trojan
Behaviour
outlook_win_path
outlook_office_path
Views/modifies file attributes
Uses Volume Shadow Copy service COM API
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Delays execution with timeout.exe
Checks SCSI registry key(s)
Event Triggered Execution: Installer Packages
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Hide Artifacts: Hidden Files and Directories
Enumerates connected drives
Contacts third-party web service commonly abused for C2
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Executes dropped EXE
Checks computer location settings
Modifies Windows Firewall
Downloads MZ/PE file
Command and Scripting Interpreter: PowerShell
Family: Xworm
Detect Xworm Payload
Malware Config
C2 Extraction:
102.220.160.217:7004
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.