MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 20


Intelligence 20 IOCs 1 YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df
SHA3-384 hash: ba5bcdfdb6b37c2df7517eafc951acef744ef49cd7297db82e145faa0c94e091f9ad1fae77bb24f817f84a683a88ea22
SHA1 hash: 1a7cab07031001ed18998f2fd48783b4972d0d0b
MD5 hash: 861acf37ccd36d6fd81aff6cc33f583b
humanhash: item-friend-three-maryland
File name:861acf37ccd36d6fd81aff6cc33f583b.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:35'328 bytes
First seen:2025-08-13 10:45:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 768:WM0LbBYtwjoszZzxFVFyw9ZdXLO/hhSjzmi:cbBrjrzpFP9ZdXLO/bazmi
Threatray 1'486 similar samples on MalwareBazaar
TLSH T1CFF26C0877904326D9FD5FF46DB3B10A42B4F6178527DB4E0CD48A9A3B73AC28A017E6
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe xworm


Avatar
abuse_ch
XWorm C2:
147.45.210.191:7000

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
147.45.210.191:7000 https://threatfox.abuse.ch/ioc/1567364/

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df.exe
Verdict:
Malicious activity
Analysis date:
2025-08-13 10:48:31 UTC
Tags:
xworm
Link:
https://app.any.run/tasks/10de0800-4c5e-467b-ba08-db407d08eec3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/21124/
Detection(s):
Win.Packed.njRAT-10002074-1
Create hunting rule

Win.Packed.Msilzilla-10002982-0
Create hunting rule

Win.Packed.Msilzilla-10019837-0
Create hunting rule

Win.Packed.Loveletter-10023052-0
Create hunting rule

Win.Packed.Loveletter-10024677-0
Create hunting rule

Win.Packed.Msilzilla-10026193-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.AsyncRAT.UNOFFICIAL
Create hunting rule

ditekSHen.MALWARE.Win.XWorm.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689c6cd131e468d9372467ad
Tags:
asyncrat autorun
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% directory
Launching a process
Creating a process with a hidden window
Creating a window
Connection attempt
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Running batch commands
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm asyncrat base64 bladabindi fingerprint lolbin njrat njrat rat reconnaissance schtasks vbnet xworm
Link:
https://www.filescan.io/uploads/689c6cde6d7bffa0a7a17fe2/reports/fdff65f9-db95-44f4-9938-9249c7d4c316/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2e836a86-e9f2-4e16-bc49-be5d7dc3bc48
Result
Threat name:
XWorm, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1755957
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Found malware configuration
Found strings related to Crypto-Mining
Found suspicious powershell code related to unpacking or dynamic code loading
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sample uses string decryption to hide its real strings
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Stop EventLog
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Xmrig cryptocurrency miner
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1755957 Sample: 4bddmVz7eA.exe Startdate: 13/08/2025 Architecture: WINDOWS Score: 100 90 monerooceans.stream 2->90 92 gulf.moneroocean.stream 2->92 96 Suricata IDS alerts for network traffic 2->96 98 Found malware configuration 2->98 100 Malicious sample detected (through community Yara rule) 2->100 102 23 other signatures 2->102 10 powershell.exe 2->10         started        13 4bddmVz7eA.exe 1 16 2->13         started        17 esdzadxkgdsl.exe 2->17         started        19 5 other processes 2->19 signatures3 process4 dnsIp5 122 Writes to foreign memory regions 10->122 124 Modifies the context of a thread in another process (thread injection) 10->124 126 Injects a PE file into a foreign processes 10->126 21 dllhost.exe 10->21         started        24 conhost.exe 10->24         started        94 147.45.210.191, 49691, 7000 FREE-NET-ASFREEnetEU Russian Federation 13->94 82 C:\Users\user\AppData\Roaming\XClient.exe, PE32 13->82 dropped 84 C:\Users\user\AppData\Local\Temp\zmvdke.exe, PE32+ 13->84 dropped 128 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->128 130 Protects its processes via BreakOnTermination flag 13->130 132 Uses schtasks.exe or at.exe to add and modify task schedules 13->132 134 Loading BitLocker PowerShell Module 13->134 26 zmvdke.exe 1 2 13->26         started        29 schtasks.exe 1 13->29         started        86 C:\Windows\Temp\klfepudurmlk.sys, PE32+ 17->86 dropped 136 Multi AV Scanner detection for dropped file 17->136 138 Adds a directory exclusion to Windows Defender 17->138 140 Sample is not signed and drops a device driver 17->140 31 powershell.exe 17->31         started        33 dialer.exe 17->33         started        36 cmd.exe 17->36         started        40 7 other processes 17->40 142 Antivirus detection for dropped file 19->142 144 Changes security center settings (notifications, updates, antivirus, firewall) 19->144 38 conhost.exe 19->38         started        file6 signatures7 process8 dnsIp9 104 Contains functionality to inject code into remote processes 21->104 106 Writes to foreign memory regions 21->106 108 Creates a thread in another existing process (thread injection) 21->108 120 2 other signatures 21->120 42 winlogon.exe 21->42 injected 44 lsass.exe 21->44 injected 53 2 other processes 21->53 80 C:\ProgramData\...\esdzadxkgdsl.exe, PE32+ 26->80 dropped 110 Multi AV Scanner detection for dropped file 26->110 112 Modifies the context of a thread in another process (thread injection) 26->112 114 Adds a directory exclusion to Windows Defender 26->114 47 powershell.exe 23 26->47         started        55 11 other processes 26->55 49 conhost.exe 29->49         started        116 Loading BitLocker PowerShell Module 31->116 51 conhost.exe 31->51         started        88 monerooceans.stream 66.23.199.44 ANYNODEUS United States 33->88 118 Query firmware table information (likely to detect VMs) 33->118 57 2 other processes 36->57 59 5 other processes 40->59 file10 signatures11 process12 signatures13 61 dllhost.exe 42->61         started        146 Writes to foreign memory regions 44->146 148 Found suspicious powershell code related to unpacking or dynamic code loading 47->148 150 Loading BitLocker PowerShell Module 47->150 64 conhost.exe 47->64         started        66 conhost.exe 55->66         started        68 conhost.exe 55->68         started        70 wusa.exe 55->70         started        72 8 other processes 55->72 process14 signatures15 152 Injects code into the Windows Explorer (explorer.exe) 61->152 154 Writes to foreign memory regions 61->154 156 Creates a thread in another existing process (thread injection) 61->156 158 Injects a PE file into a foreign processes 61->158 74 svchost.exe 61->74 injected 76 svchost.exe 61->76 injected 78 svchost.exe 61->78 injected process16
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df
Verdict:
njRat
YARA:
14 match(es)
Tags:
.Net Executable njRat PE (Portable Executable) RAT SOS: 0.22 Win 32 Exe x86
Link:
https://app.malva.re/file/861acf37ccd36d6fd81aff6cc33f583b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df
Threat name:
ByteCode-MSIL.Spyware.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2025-08-10 20:12:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
33 of 38 (86.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i6xvoiacujvtz6a3i4gzhk7ge5mtmi5ypnnfgwkutvgwg57zgppq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
0264e2223b01653f3e19ebeb563ebc77086b78625b6c26675c85b470577cf7a4
XWorm
1282128d901c2381bf43222b8952e2d7f4cf0dbad4e9b0dd5a29a4eddfb56e46
XWorm
47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df
XWorm
53d1f7873ac35c78024d4c7ebee1ad2ad3bdfe5003ffbf4bec730184b4bcf738
XWorm
error
XWorm
fc53884a4452b6f808e280dc3fc3a051d0129be2aabf61ea816dacf6c3ea9e80
XWorm
+ 1'476 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xmrig family:xworm defense_evasion execution miner persistence rat trojan upx
Link:
https://tria.ge/reports/250813-mtn9rswk18/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
UPX packed file
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Creates new service(s)
Stops running service(s)
XMRig Miner payload
Contains code to disable Windows Defender
Detect Xworm Payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Xmrig family
Xworm
Xworm family
xmrig
Malware Config
C2 Extraction:
147.45.210.191:7000
Verdict:
Malicious
Tags:
rat xworm Win.Packed.njRAT-10002074-1
YARA:
MALWARE_Win_XWorm win_mal_XWorm
Link:
https://app.threat.zone/submission/5deda6c3-36e7-4d88-820c-8a6dbeb6a7c0
Unpacked files
SH256 hash:
47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df
MD5 hash:
861acf37ccd36d6fd81aff6cc33f583b
SHA1 hash:
1a7cab07031001ed18998f2fd48783b4972d0d0b
Detections:
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
Link:
https://www.unpac.me/results/9b13a337-38fa-4624-8472-bba067ba5df8/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/47af572002a2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47af572002a26b3cf81b470d93abe627593623b87b5a5359549d4d6377f933df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/21124/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments