MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659
SHA3-384 hash: 2c77ef7be9f2e6577c16f9445b3d0615e3ea1ea529467f0703262db5743c8640be51375af481046beebc2b8ddeca826c
SHA1 hash: 7534e0f45452f9dc8956fa3dee4f500b68a9d54f
MD5 hash: 8c1ae52338302b6534afa05620273a5a
humanhash: ohio-uniform-pennsylvania-island
File name:Zapytanie_ofertowe_OMEGA_Sp. z o.o. _82100982.bat
Download: download sample
Signature XWorm
Create hunting rule
File size:10'721 bytes
First seen:2025-11-07 07:59:45 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 192:Du8j1I7HNQs0AsHSppMSppMSppMSppMSppMSppMSppMSppMSppMSppMSppMSppMI:D/j1I7HNQ3Asypp3pp3pp3pp3pp3pp3L
Threatray 2'367 similar samples on MalwareBazaar
TLSH T17122FC41EE04635AF467D50B42739A261BCCC6F702C48D9936F8938FE915EFAE872C51
Magika batch
Reporter Anonymous
Tags:bat xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
PL PL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Zapytanie_ofertowe_OMEGA_Sp. z o.o. _82100982.bat
Verdict:
No threats detected
Analysis date:
2025-11-07 08:02:27 UTC
Tags:
susp-powershell
Link:
https://app.any.run/tasks/594eb0ed-1651-4858-aa59-81bbf85f396a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/36415/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690da7403afb53888cc94080
Tags:
xtreme shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 base64 batch obfuscated obfuscated opendir overlay powershell
Link:
https://www.filescan.io/uploads/690da739a73a3741e07fa280/reports/44d2dc5c-5547-45bb-bb57-9a1609987358/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659
Verdict:
Malicious
File Type:
text
First seen:
2025-11-06T18:11:00Z UTC
Last seen:
2025-11-07T17:57:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan.BAT.Generic
Link:
https://opentip.kaspersky.com/4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659/results?tab=lookup
Result
Threat name:
Caminho Loader, XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1809793
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Caminho Loader
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1809793 Sample: Zapytanie_ofertowe_OMEGA_Sp... Startdate: 07/11/2025 Architecture: WINDOWS Score: 100 29 plentymattersub.duckdns.org 2->29 31 ia600407.us.archive.org 2->31 33 ecohaus.webd.pl 2->33 43 Suricata IDS alerts for network traffic 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 51 15 other signatures 2->51 8 cmd.exe 1 2->8         started        11 powershell.exe 16 2->11         started        13 powershell.exe 2->13         started        signatures3 49 Uses dynamic DNS services 29->49 process4 signatures5 53 Suspicious powershell command line found 8->53 55 Bypasses PowerShell execution policy 8->55 15 powershell.exe 14 15 8->15         started        19 conhost.exe 8->19         started        21 conhost.exe 11->21         started        23 conhost.exe 13->23         started        process6 dnsIp7 35 ecohaus.webd.pl 194.181.228.75, 443, 49720, 49721 NASK-COMMERCIALPL Poland 15->35 37 ia600407.us.archive.org 207.241.227.217, 49719, 80 INTERNET-ARCHIVEUS United States 15->37 39 Writes to foreign memory regions 15->39 41 Injects a PE file into a foreign processes 15->41 25 CasPol.exe 4 15->25         started        27 conhost.exe 15->27         started        signatures8 process9
Score:
9%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659/
Verdict:
Malicious
Threat:
Trojan.BAT
Link:
https://tip.neiki.dev/file/4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-11-07 01:00:21 UTC
File Type:
Text (Batch)
AV detection:
12 of 38 (31.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jihqw3qsmvf357jhfk3uptx22mtvcvxwwdnz5dotbnryqdufqzmq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
220e5c0ee3fec540448955bb9f2c5324c0a01d65323b48b00caed7a45d5df6ef
XWorm
3a444e7690f35fee4be070d0656bc7f0adab9bdcec798d5af27fc3c93e08f611
XWorm
3b39da6b761aebfac6324138212fd5a6eeb89a50ef1e7b8f8a813c07ac920062
XWorm
41cdbafba89bad77d1784458e5c226eb405ca9f46bb65a38031c48a97e6eef84
XWorm
61c99aca559a36c194dac72b7871716b26722cbcc3510e77f9354d942f0cf021
XWorm
732975f6429f6127a1927f1a5ebeb2a28b2d64e8b7b2c22df37708ac165074cc
XWorm
error
XWorm
+ 2'357 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:phantomvai family:xworm discovery execution loader persistence rat trojan
Link:
https://tria.ge/reports/251107-jwf5ds1lcv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Detects PhantomVAI loader aka VMDetectLoader, CaminhoLoader
PhantomVAI, VMDetectLoader, CaminhoLoader
Phantomvai family
Xworm
Xworm family
Malware Config
C2 Extraction:
manythingsilove.duckdns.org:5290
plentymattersub.duckdns.org:5290
pradaguccimaneto.freeddns.org:5290
Dropper Extraction:
http://ia600407.us.archive.org/7/items/msi-pro-with-b-64_202511/MSI_PRO_with_b64.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Batch (bat) bat 4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/36415/

Comments