MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99
SHA3-384 hash: 771810c43d7a43c9c52fed17c15b114fae34bbd38e6836e3b231c255ed6c26cab80d6dd2754c8c7b8084518f686007c6
SHA1 hash: be22d106c0fc2fa9a83984aec1e8494975e73989
MD5 hash: ee1002868fa5370dcf21358f5c3e2672
humanhash: social-yellow-cardinal-hydrogen
File name:762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99
Download: download sample
Signature XWorm
Create hunting rule
File size:37'248 bytes
First seen:2026-02-04 15:08:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 384:s8R5GuuaSQVCIgRedItL0nfiYPFbVcp464aKJmQN07pkFMAfNLTYOZwp3V2v99Ij:HDj5IxGfxdxcqmkbFJ9YNOMha3nze
TLSH T1ABF25D083B944627DAFF6FF55DB371021670F5039913E78D48D89AAA6F237C085147AB
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter adrian__luca
Tags:exe xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51703/
Detection(s):
Win.Packed.njRAT-10002074-1
Create hunting rule

Win.Packed.Msilzilla-10019837-0
Create hunting rule

Win.Packed.Loveletter-10023052-0
Create hunting rule

Win.Packed.Loveletter-10024677-0
Create hunting rule

Win.Packed.Msilzilla-10026193-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.AsyncRAT.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698361219a60ec70d92cc6f1
Tags:
asyncrat stration micro remo
Verdict:
Malicious
Labled as:
Suspicious:TrojanDrop.Agent.A.gaau
Link:
https://www.hybrid-analysis.com/sample/762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99
Result
Gathering data
Verdict:
Clean
File Type:
exe x32
Link:
https://opentip.kaspersky.com/762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/a1c9e3ff-bc34-420a-8b38-4ee228e27ff5
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99
Verdict:
XWorm
YARA:
13 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE Memory-Mapped (Dump) RAT XWorm
Link:
https://app.malva.re/file/ee1002868fa5370dcf21358f5c3e2672
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oysglvfnnylpuuowz6lgwstinlm3ik3wf64vxxpe4oqwgiirbsmq._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm
Link:
https://tria.ge/reports/260204-sjkfqabv6f/
Unpacked files
SH256 hash:
762465d4ad6e16fa51d6cf966b4a686ad9b42b762fb95bdde4e3a16321110c99
MD5 hash:
ee1002868fa5370dcf21358f5c3e2672
SHA1 hash:
be22d106c0fc2fa9a83984aec1e8494975e73989
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
Link:
https://www.unpac.me/results/12559ca4-1c2b-453e-b9d1-c7b0a9cfe9b1/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:NETDIC208_NOCEX_NOREACTOR
Create hunting rule
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Trojan_XWorm_b7d6eaa8
Create hunting rule
Author:Elastic Security
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/51703/

Comments