MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39310dd2eaae889d46e05ad8d231a6da7977e7b47d864ed0b5db0b66b2f57010. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	39310dd2eaae889d46e05ad8d231a6da7977e7b47d864ed0b5db0b66b2f57010
SHA3-384 hash:	a7fcfb8718528491d996b1ce941160ae35d96c54c581f708c707b02fb45217ac743c2336e607b7851b7ae757dea1cca1
SHA1 hash:	8cef30a04c83ad26c535d117ea1c657bce8a00c4
MD5 hash:	2cd994223a11ff0ae1228e561f1ca519
humanhash:	massachusetts-robin-east-ceiling
File name:	z1NEWP0n0_47990.bat
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	185'500 bytes
First seen:	2025-03-24 06:30:09 UTC
Last seen:	2025-03-24 14:01:14 UTC
File type:	bat
MIME type:	text/plain
ssdeep	3072:gHftcEH16S4v+iVH7QtGkBfxnNm29mJB5B5wH20TjeCPM:gHfrUSW8G0m29mJB5B5wH20TjC
TLSH	T1DB044B7FC2E8AED5035B10F1255C3649BE08FFD6B253C68DFD7801A12290B969E7A61C
Magika	latex
Reporter	FXOLabs
Tags:	bat xworm

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

93

Origin country :

BR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

z1NEWP0n0_47990.bat

Verdict:

Malicious activity

Analysis date:

2025-03-25 04:14:03 UTC

Tags:

susp-powershell xworm remote

Link:

https://app.any.run/tasks/0299ae82-32c7-430e-9469-7767accdc032

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e24bedbb84e066269ed927

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated obfuscated

Link:

https://www.filescan.io/uploads/67e0fd32c26eb3fd74f4e2e5/reports/85f18b8a-d619-40ee-b6a6-4a660ee2fdad/overview

Hybrid Analysis BAT/Agent.AZY

Verdict:

Suspicious

Labled as:

BAT/Agent.AZY

Link:

https://www.hybrid-analysis.com/sample/39310dd2eaae889d46e05ad8d231a6da7977e7b47d864ed0b5db0b66b2f57010

Joe Sandbox Batch Injector, XWorm

Result

Threat name:

Batch Injector, XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1646701

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/39310dd2eaae889d46e05ad8d231a6da7977e7b47d864ed0b5db0b66b2f57010

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/39310dd2eaae889d46e05ad8d231a6da7977e7b47d864ed0b5db0b66b2f57010/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-03-24 06:31:08 UTC

File Type:

Text (PowerShell)

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=heyq3uxkv2ej2rxallmnemng3j4xpz5upwde5ufv3mfwnmxvoaia._file

Threatray xworm

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

Similar samples:

error

XWorm

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm execution rat trojan

Link:

https://tria.ge/reports/250324-g9j24avns7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

freeetradingzone.duckdns.org:3911

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.