MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 314d8cb6f584f4c81077371a7a1cb7bacfe8e20f9345937b711a1bc3bef51770. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 16
| SHA256 hash: | 314d8cb6f584f4c81077371a7a1cb7bacfe8e20f9345937b711a1bc3bef51770 |
|---|---|
| SHA3-384 hash: | d896c11687bb3023c75d18f8a1dacfed41f83b570f01d49fc9b99518c353dd6500ee9edf7582ab2b8ee32de102cfcca0 |
| SHA1 hash: | a6e16be7b216f6cc4217de29f580da7effdc7d78 |
| MD5 hash: | e1024c8e2a3ea6943d644ca629cc4c01 |
| humanhash: | asparagus-carolina-white-november |
| File name: | RAZORRATENCRYPTED_Crack.exe |
| Download: | download sample |
| Signature | XWorm |
| File size: | 13'922'304 bytes |
| First seen: | 2025-02-18 22:35:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 532d3d356542eefd275ac817aaf43a7e (1 x XWorm) |
| ssdeep | 196608:bBKGYrItNPRa5d9gtlSVT7mLwurKNHL8GOgxCV+iLsycR+wiOE8TZCoVYCZczG5T:ljY0tF8LI4lur+nOgxO5w+Bt0Nt |
| TLSH | T1A4E6336C84FE55ACC2D497F768A10083EFF7BE6E96541D7F7EFAA00E094199064C01AE |
| TrID | 40.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 16.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 12.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.0% (.EXE) Win32 Executable (generic) (4504/4/1) 5.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | 009286868686f800 (4 x Stealc, 4 x AgentTesla, 3 x Smoke Loader) |
| Reporter |  BastianHein |
| Tags: | exe xworm |
Intelligence
File Origin
# of uploads :
1
# of downloads :
609
Origin country :
CLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RAZORRATENCRYPTED_Crack.exe
Verdict:
Malicious activity
Analysis date:
2025-02-18 22:00:15 UTC
Tags:
darkvision rat remote xworm
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Verdict:
Malicious
Score:
99.9%
Tags:
medusalocker infosteal emotet
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a file
Creating a process from a recently created file
Searching for synchronization primitives
Searching for the window
Creating a window
Connection attempt to an infection source
Unauthorized injection to a recently created process
Query of malicious DNS domain
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
ShellCode.Donut.Marte.4.Generic
Result
Verdict:
MALICIOUS
Malware family:
XWorm
Verdict:
Malicious
Gathering data
Score:
99%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Exploit.DonutMarte
Status:
Malicious
First seen:
2025-02-18 22:00:16 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
14 of 37 (37.84%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xworm discovery rat trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
H30x25-31684.portmap.host:46388
Verdict:
Malicious
Tags:
loader Win.Packed.Rozena-10029918-0
YARA:
Windows_Trojan_Donutloader_f40e3759
Unpacked files
SH256 hash:
314d8cb6f584f4c81077371a7a1cb7bacfe8e20f9345937b711a1bc3bef51770
MD5 hash:
e1024c8e2a3ea6943d644ca629cc4c01
SHA1 hash:
a6e16be7b216f6cc4217de29f580da7effdc7d78
SH256 hash:
4db1b1ef3da9f421d96744c70fa4a02b229496991bdfa383ca7a22f4a9e7b893
MD5 hash:
1fdc3ab9408e8cb1d75ddbc48578a59e
SHA1 hash:
b95edc4e36c0e86ac2744f610f869b6bfb780be0
Detections:
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
SH256 hash:
57d58fa77d40bc4f0ab6f41680f4c4888166399edb10c25267528f9bb6f87bf4
MD5 hash:
ac6bbab72e675d9cc5068d7f747b1943
SHA1 hash:
61bef45bb46dab7c6b0a62dfad11991a698011ad
Detections:
win_xworm_w0
XWorm
win_mal_XWorm
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
MALWARE_Win_AsyncRAT
MALWARE_Win_XWorm
SH256 hash:
f361dc1046da4b51f733810ab99d6f01496645629f47a3c5105f3d32962e3dab
MD5 hash:
5c477bc67e833f3588223d66f20fcae7
SHA1 hash:
7d8d22ae7ca5901d5cd6e4e6bd838fbdee2ebdf6
Detections:
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Malware family:
XWorm
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | Windows_Trojan_Donutloader_f40e3759 |
|---|---|
| Author: | Elastic Security |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.