🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f
SHA3-384 hash: 2e3008e40d856c89d50ca9fb5ebd6bb9bdb03c66e28fd4bdf98062a0a41ebf21231f7ced01d1000c5b3200085f6cb245
SHA1 hash: 88d545c5e7bd59521ec73caee13259fc46c7b14e
MD5 hash: d75b3be509fb4f8e936579f2f7ba968f
humanhash: lemon-three-nitrogen-cola
File name:5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f
Download: download sample
Signature XWorm
Create hunting rule
File size:762'368 bytes
First seen:2026-07-07 14:42:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'234 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 12288:ImsAAxpN0fiD9C52ZqSLNW54KBysCc1TKb0gXLodd01sevie8grGz53LNxzSOL:ILLs0sgZqSLA1BysCc1GJXk8/Mb3LNz
Threatray 55 similar samples on MalwareBazaar
TLSH T1D2F4127E4D862F15CA3D1EBDC4B318A433F1C403A252E7272EFC40F26AA7B564D62912
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5d966c79-fee3-4117-a16f-50a94f0d729e/
Malware family:
n/a
ID:
1
File name:
5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f.exe
Verdict:
No threats detected
Analysis date:
2026-07-07 17:07:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a53db40d-23a9-44e7-8188-3955c2485efe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73526/
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypt obfuscated obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6a4d14412c20fd358446921e/reports/dc4c93b0-ca76-4f0a-b497-25c1cba63b6c/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-12T12:44:00Z UTC
Last seen:
2026-07-09T11:59:00Z UTC
Hits:
~10000
Detections:
HEUR:Backdoor.MSIL.XWorm.gen VHO:Backdoor.Win32.Agent.gen Trojan.MSIL.Inject.sb Trojan.MSIL.Inject.b PDM:Trojan.Win32.Generic Backdoor.MSIL.XWorm.b Backdoor.MSIL.XWorm.a Backdoor.Agent.TCP.C&C
Link:
https://opentip.kaspersky.com/5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/25f1637b-2e1c-4069-920b-6700ccc619f9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/d75b3be509fb4f8e936579f2f7ba968f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f/
Verdict:
Malicious
Threat:
Backdoor.MSIL.XWorm
Link:
https://tip.neiki.dev/file/5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2026-06-12 17:58:37 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvu3gzzk2fzbnvkdpws73hbm3qt4exbfc2owd2y2rehjsxvc34hq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
29959205ea2e521181bcf94150fb57aa78e3661c361234f27a5de2afb254e7b8
XWorm
9a2efe3df697037fac5fdc4b70ff84086e64fd6d9f82c9335992a2dd0ffb0abd
XWorm
b064db45193ce571396ff195824ae113a33af2ad516bfe2322ea13c9cc1ce2c4
XWorm
c2a383a0dff5e69299443a119bb73f2b76f3f9c0f3951330ffea5db26fc3797f
XWorm
+ 45 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/260707-ssc31ags3x/
Behaviour
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Enumerates connected drives
.NET Reactor proctector
Boot or Logon Autostart Execution: Active Setup
Unpacked files
SH256 hash:
5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f
MD5 hash:
d75b3be509fb4f8e936579f2f7ba968f
SHA1 hash:
88d545c5e7bd59521ec73caee13259fc46c7b14e
Link:
https://www.unpac.me/results/200c38c9-c606-4c48-90a1-2d73455f29bf/
SH256 hash:
c0f6bbb0d5eb59fe92ffe46e7292b50f1b21594cc098d6a9500419c3914131a3
MD5 hash:
515aea6ac4c21f9a446676978958d003
SHA1 hash:
082505696e5df5bcaa2b5b1ff556f61e4d1309cb
Link:
https://www.unpac.me/results/200c38c9-c606-4c48-90a1-2d73455f29bf/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73526/

Comments