MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e
SHA3-384 hash: 10e5a68694645a85499f7e8a1d8158ec7ecf430e4ff176d30b3e2264a324e15c04184687746a390dbe63aaa834f323c0
SHA1 hash: 504d7709f86a096846cc8d28fbc38749b53c56e0
MD5 hash: 5e45c1b1a90a8ef8a4c83d303336243b
humanhash: sixteen-early-indigo-nine
File name:TerryHackExtra.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:14'421'504 bytes
First seen:2025-12-22 21:06:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 393216:2AgTIlGsKhJprtkNYbl0hVRPRbW/mH6cI0gZAQXo:fglzpJeRRy26vAQX
Threatray 117 similar samples on MalwareBazaar
TLSH T10DE63345C8E97C74929805F4F0A1A1F5B438735F1E4796BADF93A2C1CE5306B4A3AB2C
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter burger
Tags:exe xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
EvilCoder
Details
EvilCoder
extracted components, their filepaths, and possibly registry installation
Link:
https://research.acce.ciphertechsolutions.com/results/555f897a-3749-4bc5-952a-d10c87036cc3/
Malware family:
n/a
ID:
1
File name:
TerryHackExtra.exe
Verdict:
Malicious activity
Analysis date:
2025-12-22 21:06:24 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/e9220adc-813d-479a-9b9c-938ad926e760

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45779/
Detection(s):
Win.Packed.Msilzilla-10008147-0
Create hunting rule

Win.Packed.Packy-10036375-0
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6949b2cda6c88bb4cc23ab16
Tags:
dropper remo hype
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-22T17:27:00Z UTC
Last seen:
2025-12-24T08:09:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic Backdoor.MSIL.Mason.sb HEUR:Trojan-Spy.MSIL.Bobik.gen HEUR:Trojan.MSIL.Xdwd.gen HEUR:Trojan.MSIL.Fsysna.gen Trojan.Win32.Vimditator.sb
Link:
https://opentip.kaspersky.com/71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/aefd7a03-db00-4daa-82ef-353dac6cb705
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1837891
Signature
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.22 Win 64 Exe x64
Link:
https://app.malva.re/file/5e45c1b1a90a8ef8a4c83d303336243b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e/
Verdict:
Malicious
Threat:
Trojan.MSIL.Vimditator
Link:
https://tip.neiki.dev/file/71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e
Threat name:
ByteCode-MSIL.Trojan.XWormRAT
Create hunting rule
Status:
Malicious
First seen:
2025-12-22 21:07:51 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
4
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ohugaesbq6nx77k72ssqsoiyzvz6olqwbiposnokpwnzrtxzs2ha._file
Verdict:
malicious
Label(s):
unc_loader_063
Create hunting rule
Similar samples:
1c28d30ab1ce4eb57e0e49395d86bd5641b732066af777296be3aac2e11a06cc
XWorm
4e4cd33d3fa45c318de3aeb0a0f1d439a9d5fa94f802bc0b0d7efa310d2329cf
XWorm
7cc9673598993d033f68cf3c19e12078f22ce35d5fcedebe9cd5e8f4d4d6cb8d
XWorm
903387d93c8c1a877a89e1c8cb95b56ae96762f8694b0f95ee05ec6676936aa1
XWorm
error
XWorm
+ 107 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/251222-zxzk5atpgz/
Behaviour
Suspicious use of AdjustPrivilegeToken
Looks up external IP address via web service
Verdict:
Malicious
Tags:
Win.Packed.Msilzilla-10008147-0 External_IP_Lookup
YARA:
n/a
Link:
https://app.threat.zone/submission/668ff50b-8c49-4809-855d-5b45215b8d2e
Unpacked files
SH256 hash:
71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e
MD5 hash:
5e45c1b1a90a8ef8a4c83d303336243b
SHA1 hash:
504d7709f86a096846cc8d28fbc38749b53c56e0
Link:
https://www.unpac.me/results/9cbff7ff-5b87-4d00-99f8-f3e397e2a8a4/
SH256 hash:
5d51025b91160c6c2ff7b0fbe23d7720ed27054a3a49cf13b5478c40a84b76dd
MD5 hash:
edae71c5fbc7f44e3f05fc2ab7b3dc85
SHA1 hash:
e136f6681a18f276762aa6cb84e9b5d37fe5f863
Link:
https://www.unpac.me/results/9cbff7ff-5b87-4d00-99f8-f3e397e2a8a4/
SH256 hash:
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 hash:
16e5a492c9c6ae34c59683be9c51fa31
SHA1 hash:
97031b41f5c56f371c28ae0d62a2df7d585adaba
Link:
https://www.unpac.me/results/9cbff7ff-5b87-4d00-99f8-f3e397e2a8a4/
Malware family:
Alcatraz
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/71e860124187/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45779/

Comments