MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d5d33859f7e256a6b2f84e1fdd2cc518b2dfcf8dcbe9ae430c535ee4b4f3aac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4d5d33859f7e256a6b2f84e1fdd2cc518b2dfcf8dcbe9ae430c535ee4b4f3aac
SHA3-384 hash:	bb923c74eedb61cc3d1e0c73c6861ebdce3844323c1a44970eef7aad3758ab7c0f1ae75773e87678fe800c82647c14e1
SHA1 hash:	2a3a41d34868e6783e9000b24373824c602308ba
MD5 hash:	c6311e9115c21f3ab975104b8f1f97fe
humanhash:	arizona-moon-sad-romeo
File name:	H2RYMPTBX.ps1
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	44'376 bytes
First seen:	2025-08-21 06:26:40 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	768:a2qTtnawFoZdwj/Iz+YrZEylNeDGjfMGcygxl9g:8JaFdwj/I+0CgLjEGcyuly
TLSH	T113133A335923FCD1BB7F2D80F50439651C85341787698A78FBC409AA38AA650DF2ADF8
Magika	powershell
Reporter	JAMESWT_WT
Tags:	13-49-57-111 ps1 xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

48

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a6bc588fd55a79c5298cfe

Tags:

spawn sage remo

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

base64 obfuscated

Link:

https://www.filescan.io/uploads/68a6bc54a4bdac9f5ba24373/reports/49f51c79-6a4b-4669-8599-41035c211d28/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4d5d33859f7e256a6b2f84e1fdd2cc518b2dfcf8dcbe9ae430c535ee4b4f3aac

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4d5d33859f7e256a6b2f84e1fdd2cc518b2dfcf8dcbe9ae430c535ee4b4f3aac

Malva.RE njRat

Verdict:

njRat

YARA:

1 match(es)

Tags:

.Net Base64 Block Base64 Payload Contains Base64 Block Executable Managed .NET njRat PE (Portable Executable) PE File Layout RAT SOS: 0.21 XWorm

Malware Config

C2 Extraction:

CNC: 13.49.57.111
PORT: 7000

Link:

https://app.malva.re/file/c6311e9115c21f3ab975104b8f1f97fe

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4d5d33859f7e256a6b2f84e1fdd2cc518b2dfcf8dcbe9ae430c535ee4b4f3aac/

Neiki Backdoor.MSIL.XWorm

Verdict:

Malicious

Threat:

Backdoor.MSIL.XWorm

Link:

https://tip.neiki.dev/file/4d5d33859f7e256a6b2f84e1fdd2cc518b2dfcf8dcbe9ae430c535ee4b4f3aac

ReversingLabs TitaniumCloud ByteCode-MSIL.Spyware.AsyncRAT

Threat name:

ByteCode-MSIL.Spyware.AsyncRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-20 06:16:39 UTC

File Type:

Text

AV detection:

15 of 36 (41.67%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jvothbm7pyswu2zpqtq73uwmkgfs37hy3s7jvzbqyu264s2phkwa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion execution

Link:

https://tria.ge/reports/250821-g72jcs1jw9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Modifies trusted root certificate store through registry

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4d5d33859f7e256a6b2f84e1fdd2cc518b2dfcf8dcbe9ae430c535ee4b4f3aac