MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3abb6a416e5cbc8aaa09d9ddbe421ca81abd8d120ac95db2ef743b5045c2dab1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 12
| SHA256 hash: | 3abb6a416e5cbc8aaa09d9ddbe421ca81abd8d120ac95db2ef743b5045c2dab1 |
|---|---|
| SHA3-384 hash: | e1541d928358b41372d695292988c312456859bfca508221bea1d5cab992bf1b2e2650c8b9bef060435cad9ec9f0c801 |
| SHA1 hash: | ece30a6b4c8582b44cd6e06f7f2064a429656e9b |
| MD5 hash: | 9ec1637b4dae3852ab1da73236ae4f09 |
| humanhash: | pennsylvania-violet-berlin-burger |
| File name: | Merchant_Statement_10-Nov-2025.pdf.bat |
| Download: | download sample |
| Signature | XWorm |
| File size: | 68'013 bytes |
| First seen: | 2025-11-11 09:31:25 UTC |
| Last seen: | 2026-05-20 17:33:12 UTC |
| File type: |  bat |
| MIME type: | text/plain |
| ssdeep | 1536:le6mPtKKDMcoo5KFZPNFeQJuYzevmu05ZI2UxqI44x:le9PtKKgcngJe9gI26 |
| Threatray | 1'559 similar samples on MalwareBazaar |
| TLSH | T180633B76E421169B322F27F1F8648E3F71AB6E54A1F31E7488010530DF9D94B7AE606E |
| Magika | batch |
| Reporter |  TomU |
| Tags: | bat pwd-protected rar xworm |
TomU
From: RAKBANK TEAM <noreply_RakbankPay@rakbank.ae>To: REDACTED
Subject: Merchant Statement - 10-NOV-2025
Date: Mon, 10 Nov 2025 07:02:28 -0800
Message-ID: <20251110070228.CFF56A99FDEF7DBB@rakbank.ae>
original attachment filename: "Merchant Statement 10-Nov-2025.pdf.001"
bc0145b4e32d118d5eb5e9636a9a5c55597c31aff9c79695aefef15d710c05c5 Merchant_Statement_10-Nov-2025_(pwd=RAK_6210).pdf.001.rar
3abb6a416e5cbc8aaa09d9ddbe421ca81abd8d120ac95db2ef743b5045c2dab1 Merchant_Statement_10-Nov-2025.pdf.bat
--
Dear Customer,
Please find attached your statement for your Merchant/Outlet ID 114400000006210 (sales@phc.com.jo) for the period.
To ensure that your financial information is secure, you will need to enter a password to access your statement.
To open your statement: Please enter the password as RAK_6210
Please note that any spaces in the account name should be replaced by an underscore(_) in the password.
For any further queries, you may reach us at the below touchpoints:
Email us at rakbankpay@rakbank.ae
Call us at + 97142913355
Fax at + 97143263626
Yours Sincerely,
RAKBANK
--
Intelligence
File Origin
# of uploads :
3
# of downloads :
114
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Merchant_Statement_10-Nov-2025.pdf.bat
Verdict:
Malicious activity
Analysis date:
2025-11-11 09:32:28 UTC
Tags:
github remote xworm susp-powershell
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Verdict:
Clean
Score:
82.2%
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Running batch commands
Launching cmd.exe command interpreter
Creating a file
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 evasive masquerade obfuscated powershell
Verdict:
Clean
File Type:
text
First seen:
2025-11-10T11:52:00Z UTC
Last seen:
2025-11-13T04:22:00Z UTC
Hits:
~10
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Verdict:
Susipicious
Threat name:
Script-BAT.Trojan.Heuristic
Status:
Malicious
First seen:
2025-11-11 09:32:14 UTC
File Type:
Text (Batch)
AV detection:
5 of 23 (21.74%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
xworm
Similar samples:
+ 1'549 additional samples on MalwareBazaar
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xworm execution rat trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Badlisted process makes network request
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
216.250.249.182:4040
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.PS -> URL: hXXps://raw.githubusercontent[.]com/BlackShell256/Null-AMSI/refs/heads/main/Null-4MSI.ps1
--- malware config extracted ---
Malware Configuration Extractor: Xworm {
"C2 url": ["216.250.249.182"],
"Port": 4040,
"Aes key": "<666666>",
"SPL": "<Xwormmm>",
"Install file": "USB.exe",
"Version": "XWorm V6.0"
}
https://hunting.abuse.ch/hunt/216.250.249.182/#ipintel
2025-11-10 15:42 jarm_3389 2ad2ad16d2ad2ad22c2ad2ad000000f9fdf4eeac344e8b5003264da73585be
2025-11-10 15:42 ssl_3389 {'CN': 'WIN-TVJFV24LUKT'}
2025-11-10 15:42 tcp_3389 port_open
2025-11-10 15:42 tcp_4040 port_open
2025-11-04 14:56 tcp_4040 port_open
2025-10-29 07:48 tcp_4040 port_open
2025-10-24 10:11 tcp_4040 port_open
2025-11-02 12:03 tcp_2026 port_open
2025-10-27 16:51 tcp_2026 port_open