MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a
SHA3-384 hash: f0c587e259e37d7eb30359a904925f059972bc6cb45d074af2f485192cceede5157543b67580da224044318bb79ddd29
SHA1 hash: 69307ffe902b4e79adbf2622dc83d65f2b477df0
MD5 hash: d13d793e0726847b3960d5621f09d300
humanhash: muppet-carbon-vegan-queen
File name:file2.ps1
Download: download sample
Signature XWorm
Create hunting rule
File size:1'405 bytes
First seen:2024-02-16 18:00:09 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 24:LLMn9uLrCAx6lsm4qmcjLw1dCbKHxUZh46z/KC2OKc2xbl6lmelQKDZF:Lgn8hgsp1daKHaZh46z/3R6gmQQm7
Threatray 108 similar samples on MalwareBazaar
TLSH T1A5218332011FD71F8E841010FA4EEF45ED3C51549610A788FADE9CA8C1B89BC757E69B
Reporter malwarology
Tags:ps1 xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Obfus-2314.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay
Link:
https://www.filescan.io/uploads/65cfa2e4c5e1a083fbee3eb6/reports/cd2ee96b-8fce-427d-a7d3-4926e8fb51b7/overview
Verdict:
Malicious
Labled as:
BZC.PZQ.Boxter.955
Link:
https://www.hybrid-analysis.com/sample/5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a
Result
Verdict:
MALICIOUS
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1393626
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Suspicious powershell command line found
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
Score:
4%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a/
Threat name:
Win32.Dropper.Boxter
Create hunting rule
Status:
Malicious
First seen:
2024-02-16 18:01:04 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 23 (26.09%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lwvjw3qyeghcbnzyw6nwv4kknxf6xkp76iidisxfdllg3nhx5nna._file
Verdict:
malicious
Similar samples:
28c020b8cb635d2578b6a0287f9fb077d9156c5d1ae4c5edfff2b0f2a9d7af4f
XWorm
5d396ac219738c90a4d80fd423f91470994f2c13a49f7d20f0720e62a5734a0c
XWorm
5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a
XWorm
5f86822a5a049aaa09d6f11ad557f4c2ae8ce57b37daa6b00658fff4ee1ce090
XWorm
8918ac8706f6f82a2d1a567f00f92820d48cbecf6a2dc8c79282db4e6a8a762a
XWorm
db72ae0337d3edac28c3ad0acd80f5ef24a8f54afb98484217021d26359e224e
XWorm
f96bd97ab89a17d3ff37e98cd44ed194d3f18a36690d6c2f1e29a854b354e599
XWorm
+ 98 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm persistence rat trojan
Link:
https://tria.ge/reports/240216-wlvw1see67/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Blocklisted process makes network request
Detect Xworm Payload
Xworm
Malware Config
C2 Extraction:
xwv5group7001.duckdns.org:7001
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

zip 76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993

XWorm

img 40e61a6c5f46702a808cb94a2f27c6460b5a86c9878d831213c3acd31eee1984

XWorm

Visual Basic Script (vbs) vbs f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26

XWorm

PowerShell (PS) ps1 7b34e6746d3340b778eeeee6a248b30e177d18ab71b121740552782c0d5be5aa

XWorm

PowerShell (PS) ps1 5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a

(this sample)

anyrun
any.run
https://app.any.run/tasks/5a9c1aaf-7658-4aa1-aa93-78b780ef5005
  
Dropped by
SHA256 7b34e6746d3340b778eeeee6a248b30e177d18ab71b121740552782c0d5be5aa
  
Dropped by
MD5 1ee38923768a6c95fd58dbbd94f91ceb

Comments