MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e5f27c97a9f4ca39ec96b4e636b7d84863e87f4e73885207c2183272f8f921a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2e5f27c97a9f4ca39ec96b4e636b7d84863e87f4e73885207c2183272f8f921a
SHA3-384 hash:	a6bf3af46d13473249de7edb3bf4d626cb61a2ef85ba0de50c12a0d37a6f17858f43177d2057def8c36265969dcf74b2
SHA1 hash:	e0e06e27b7343cdb1a75aacb4c539bc311530820
MD5 hash:	bedf9f8d070a5d3488689018a7156958
humanhash:	muppet-march-pluto-speaker
File name:	bedf9f8d070a5d3488689018a7156958.bat
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	171 bytes
First seen:	2025-03-13 07:11:17 UTC
Last seen:	2025-03-13 09:05:06 UTC
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	3:mKDDGKSSJJFI9IrFhkUvPkAY/KOLISBb55uVi3LlLXXdsITmsBnXJXWXLF6B:hSG8qXk0O/K8IC15uVi7lrGITHnXJmXw
Threatray	1'670 similar samples on MalwareBazaar
TLSH	T1A6C0C009504CD2353654EB24DE2E0C92F38A2EC1402437819733AE244270485EE28006
Magika	batch
Reporter	abuse_ch
Tags:	AsyncRAT bat RAT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

97

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

http://92.255.57.221/cmd.bat

Verdict:

Malicious activity

Analysis date:

2025-03-12 19:42:09 UTC

Tags:

loader remote xworm

Link:

https://app.any.run/tasks/39c16bc4-f265-4fb9-9f13-08a3827286b1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67d28ddf3962f1a6f470b929

Tags:

asyncrat trojan shell sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

Searching for the window

Using the Windows Management Instrumentation requests

Connection attempt to an infection source

Sending a TCP request to an infection source

Sending an HTTP GET request to an infection source

Unauthorized injection to a system process

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

evasive powershell

Link:

https://www.filescan.io/uploads/67d28548f8726576332fc56c/reports/0a72ea6b-cc5b-4848-b365-4227f69fd944/overview

Hybrid Analysis BAT/TrojanDownloader.Agent

Verdict:

Suspicious

Labled as:

BAT/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/2e5f27c97a9f4ca39ec96b4e636b7d84863e87f4e73885207c2183272f8f921a

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1636880

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Writes to foreign memory regions

Yara detected Powershell download and execute

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2e5f27c97a9f4ca39ec96b4e636b7d84863e87f4e73885207c2183272f8f921a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e5f27c97a9f4ca39ec96b4e636b7d84863e87f4e73885207c2183272f8f921a/

ReversingLabs TitaniumCloud Script-BAT.Packed.Generic

Threat name:

Script-BAT.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-03-13 01:07:30 UTC

File Type:

Text (Batch)

AV detection:

5 of 24 (20.83%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fzpspsl2t5gkhhwjnnhgg235qsdd5b7u444ikid4egbsol4psina._file

Threatray xworm

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

Similar samples:

2a8290c18d10fa8a7e99575855b9fb8e734ea92b1aa7dce9840282c2657ba08c

AsyncRAT

497f32eb65c30742069ce49a41270eab82d3a5cd1e36958e3608304f53507a0f

AsyncRAT

53a2f686422f9f71b69d3a9699661c96dc1375d490ea188d5141bb1e8ae89029

AsyncRAT

80a21952b87d83eb419768268b334364ecab48dbb9cbe55b967ba9636e512cab

AsyncRAT

95bd50b1c849b16159f239b176e9c48d97bc7d841441829ec974997a93cb4c1e

AsyncRAT

d0ef84c36715bc834f68415f2b16ca2e8088141a83231f27c4a7d6285d4b6d1a

AsyncRAT

error

AsyncRAT

fbb6e25ede47737ad9d540192a46117ce42c6e24c7ce60d027e36ff49cba8213

AsyncRAT

+ 1'660 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution rat trojan

Link:

https://tria.ge/reports/250313-hz45ysyxgv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

92.255.57.221:4414

Dropper Extraction:

http://92.255.57.221/a.mp4

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2e5f27c97a9f4ca39ec96b4e636b7d84863e87f4e73885207c2183272f8f921a