MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d
SHA3-384 hash:	24974f64859b63d97ef69bf3efd03593af685a376c3b901d931424bde81fd1e6c9c209150389bcfa7c06fd5bc3d54edf
SHA1 hash:	841ba2d927a97a102334da548551ce7350336561
MD5 hash:	0e5050bc6814e2a2b2fe1c5e784cea5a
humanhash:	stairway-idaho-video-hotel
File name:	mscorsvc.dll
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	103'424 bytes
First seen:	2025-12-03 14:06:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c557e5a1f458562742f2063e4d1c8d84 (1 x XWorm)
ssdeep	3072:B3nPCRxK1PAr9rpfkeMjSyPZ2aBC71WVjKB:B3PCRxEYncjSwF014j0
Threatray	1'755 similar samples on MalwareBazaar
TLSH	T1EAA38C791DBDE34AF38C90FAF815DFD29820B04859A5A363ED6DEBE03B254401F69391
TrID	38.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.6% (.ICL) Windows Icons Library (generic) (2059/9) 15.4% (.EXE) OS/2 Executable (generic) (2029/13) 15.2% (.EXE) Generic Win/DOS Executable (2002/3) 15.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	Anonymous
Tags:	dll exe xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

109

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

mscorsvc.dll

Verdict:

Suspicious activity

Analysis date:

2025-12-03 14:12:17 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/dd59bcb3-9a5e-4962-ae1f-70d5baa315b6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox XWorm

Detection:

XWorm

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/42301/

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6930441a16e6db515e46494c

Tags:

keylog virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Connection attempt to an infection source

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending a custom TCP request

Setting a global event handler for the keyboard

Query of malicious DNS domain

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

dll x64

First seen:

2025-12-01T00:58:00Z UTC

Last seen:

2025-12-04T02:34:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Shellcode.sb PDM:Trojan.Win32.Generic Backdoor.MSIL.XWorm.b HEUR:Trojan.Win32.Agent.gen Trojan.Win64.DonutInjector.sb Trojan.Win64.Donut.sb Trojan.Win64.Agentb.sb

Link:

https://opentip.kaspersky.com/5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/80d61123-b68c-4466-947d-0c8dd56425a1

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d/

Neiki Family.DONUTLOADER

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d

ReversingLabs TitaniumCloud Win64.Malware.Heuristic

Threat name:

Win64.Malware.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-02 21:38:05 UTC

File Type:

PE+ (Dll)

AV detection:

16 of 23 (69.57%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l5xhemwq7vl5rndor66r67erpnf53ngee246u7lt4etwugl4vbgq._file

Threatray donutloader xworm

Verdict:

malicious

Label(s):

donutloader

Alert

Create hunting rule

xworm

Alert

Create hunting rule

Similar samples:

01a1d1e54a5a7811cb4be990c9f10c443a8e78f5ce67716f1397375ad3ce17db

XWorm

153c5641badc8df2740041f4dcbceb18fed6560af9fb704776304c96c9974bcf

XWorm

24d5c728af9ea56d4148f0d00e443db04621415c3730ab68b6ad8b8b3ec534bf

XWorm

3ed8d3644585e7a3c4e49ccb716e72950349d35144e912d7e9bc4b810abe62ac

XWorm

5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d

XWorm

dd571605c43f67c667cf409ddffd8fadbe022d45239f7aa61e584f0c2cd274f4

XWorm

ec145d51cb891b1e9a1e31088c0803371b5804baee1e766016b0a6f6e471f385

XWorm

ecbdada9891b9ff975f6f17a64bb2bdb5adc64dc680d82496df2bac84ec10ae9

XWorm

error

XWorm

f4073f71a9d0616905a018e6f42c60530ffaad1cba3f1057d3f47b82fa3f90e5

XWorm

f59cf4ca5660457108b8fba581299630e197696c066b0e00171a2b87cac07b00

XWorm

+ 1'745 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:xworm loader rat trojan

Link:

https://tria.ge/reports/251203-re44wscr41/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Detect Xworm Payload

Detects DonutLoader

DonutLoader

Donutloader family

Xworm

Xworm family

Malware Config

C2 Extraction:

83.147.243.110:1002
pradeepprabhu705.duckdns.org:1002

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a6ce53ca-6c17-4c5d-9cb2-b032715c34a1

UnpacMe

Unpacked files

SH256 hash:

5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d

MD5 hash:

0e5050bc6814e2a2b2fe1c5e784cea5a

SHA1 hash:

841ba2d927a97a102334da548551ce7350336561

Link:

https://www.unpac.me/results/6ef091ba-aa70-45c9-a05d-3e296c27062b/

VMRay DonutLoader

Malware family:

DonutLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5f6e7232d0fd/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/42301/