MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d
SHA3-384 hash:	5d6cba40dc6900301454c4549e4f872f68b74718e9b8ac49be1a954ccf9a485cf98617a0a7d432f7ad066f88b2bc4f53
SHA1 hash:	77638afe375f1a91ef4eae460a0293ab91796d32
MD5 hash:	f7e58a7042ac583270ff6a79e57b5295
humanhash:	rugby-coffee-lion-single
File name:	bb.bat
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	1'876 bytes
First seen:	2026-03-26 21:08:24 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	48:Nb2bOD4OjyiRPjfIIaLjUCUjUTajGxjPVjnSHjtuz+uzaDXruzquz8uzTNcUsuzn:Nb2boj7PjIIAI3IOUhuHgDJvpnNcUNHL
TLSH	T12A3164474530A03BCFB65001566D9F2D5D25E8E37001AFF2249429FA58B57BFD5ED08B
Magika	batch
Reporter	noclass
Tags:	xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

104

Origin country :

US

Vendor Threat Intelligence

ACCE BatchScript_FileType

Malware configuration found for:

BatchScript

Details

BatchScript

varying reportable information from embedded commands and any observed URLs

Link:

https://research.acce.ciphertechsolutions.com/results/007e62e6-f090-4434-aa04-1f7880ffd386/

ANY.RUN asyncrat

Malware family:

asyncrat

Alert

Create hunting rule

ID:

1

File name:

phish_alert_sp2_2.0.0.0 (15).eml

Verdict:

Malicious activity

Analysis date:

2026-03-25 15:39:21 UTC

Tags:

smb webdav rat asyncrat remote dcrat darkcrystal python xworm

Link:

https://app.any.run/tasks/3d33085c-378a-45fb-86d3-4b8e917be28d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/59420/

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.IA.Suspicious.68985181.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c5a085390b996474141131

Tags:

autorun emotet

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for synchronization primitives

Launching a process

Searching for the window

Сreating synchronization primitives

Creating a file

Creating a window

Running batch commands

Creating a process with a hidden window

Changing a file

Reading critical registry keys

Moving a recently created file

Replacing files

DNS request

Connection attempt

Enabling autorun by creating a file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

alien evasive explorer lolbin obfuscated opendir persistence powershell powershell

Link:

https://www.filescan.io/uploads/69c62fb42346b9da57aa8d16/reports/aa5abf36-422b-4d4b-bdf7-6da76e1c479a/overview

Hybrid Analysis TrojanDownloader/PS.Agent

Verdict:

Suspicious

Labled as:

TrojanDownloader/PS.Agent

Link:

https://www.hybrid-analysis.com/sample/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-03-26T18:25:00Z UTC

Last seen:

2026-03-28T01:51:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Agent.sb Trojan.Python.Injector.e HEUR:HackTool.Python.Injector.gen HEUR:Trojan.BAT.Alien.gen

Link:

https://opentip.kaspersky.com/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d/results?tab=lookup

Nucleon Malprob Malware

Score:

79%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d/

Neiki Family.XWORM

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d

ReversingLabs TitaniumCloud Win32.Trojan.Qwexlafiba

Threat name:

Win32.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-26 21:09:32 UTC

File Type:

Text (Batch)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fsvtkv3nicun2ue6yvgquzsulf7skzxr4l5q7ildkvz4heogbioq._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat family:xworm botnet:default discovery execution rat trojan

Link:

https://tria.ge/reports/260326-zzlgaaa19z/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Drops startup file

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Async RAT payload

AsyncRat

Asyncrat family

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

91.92.240.127:6000
91.92.242.249:7377

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2cab35576d40a8dd509ec54d0a6654597f2566f1e2fb0fa1635573c391c60a1d

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/59420/