MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71bb372ef5a9b7b2e699677fa1f4c4f3b6bf80906b6303adba711313e28809f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments

SHA256 hash:	71bb372ef5a9b7b2e699677fa1f4c4f3b6bf80906b6303adba711313e28809f4
SHA3-384 hash:	93b1d512285e0f1b9ec9df3a8f2762c64ec87ed331d7c6b0c0046e401ffbe87759f30ee7ae4f213ce4adf3ecb741697c
SHA1 hash:	d31d6b004ba316a2795605593ece33bfd4e6b234
MD5 hash:	5611f40a5fdbd2228f756a72dcdbe306
humanhash:	mike-angel-salami-helium
File name:	OVERDUE_INVOICE#223377.zip
Download:	download sample
Signature	XWorm Create hunting rule
File size:	47'393 bytes
First seen:	2025-11-10 15:02:46 UTC
Last seen:	2025-11-10 15:13:58 UTC
File type:	zip
MIME type:	application/zip
ssdeep	768:gZr+PHjRONKdQVP8WfhokG/CBkGZX25iHQ4WTC7LVVbRZbOjHwIkSjleTJKFDyaM:gZMH4NQgP8olK2Y5QZ7LVVbzbOjHwVS6
TLSH	T1702302737BA3764074AD52BB05DF1D64D2ACB02E4811BA9C73F084995403FA8B90DFDA
Magika	zip
Reporter	cocaman
Tags:	INVOICE xworm zip

cocaman

Malicious email (T1566.001)
From: "Pedro Pereira <vassmarica@greendivizio.hu>" (likely spoofed)
Received: "from greendivizio.hu (unknown [147.124.211.184]) "
Date: "4 Nov 2025 10:18:11 -0800"
Subject: "OVERDUE_INVOICE #223377 11/4/2025"
Attachment: "OVERDUE_INVOICE#223377.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	OVERDUE_INVOICE#223377.bat
File size:	137'993 bytes
SHA256 hash:	ea39e1ff62f15085895b999a95ccb530e5ea7244b48d838056e606fa17dbb63a
MD5 hash:	7a2f83bf8d9752eb9fe20f90c6ec18c6
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BAT.Obfus-8.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6911feb6e2c9ded75d790a26

Tags:

n/a

Result

Verdict:

Suspicious

File Type:

Bat File

Link:

https://app.docguard.net/71bb372ef5a9b7b2e699677fa1f4c4f3b6bf80906b6303adba711313e28809f4/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 batch evasive masquerade obfuscated powershell

Link:

https://www.filescan.io/uploads/6911feb2d63f755c32c447a7/reports/3e410be2-c511-4a33-9e21-fe5e55dd4f65/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/71bb372ef5a9b7b2e699677fa1f4c4f3b6bf80906b6303adba711313e28809f4

Verdict:

Malicious

File Type:

zip

First seen:

2025-11-10T12:07:00Z UTC

Last seen:

2025-11-10T12:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/71bb372ef5a9b7b2e699677fa1f4c4f3b6bf80906b6303adba711313e28809f4/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm execution rat trojan

Link:

https://tria.ge/reports/251110-talg4azrfm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

31.40.204.73:1414

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/71bb372ef5a9b7b2e699677fa1f4c4f3b6bf80906b6303adba711313e28809f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_PS1_JAB_Pattern_Jun22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:	Internal Research

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)