🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76f71c718f9238d746ac3ad7f80e8d69e5e853eb5c3afbb0ab2550212093de1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 16


Intelligence 16 IOCs 2 YARA 56 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76f71c718f9238d746ac3ad7f80e8d69e5e853eb5c3afbb0ab2550212093de1d
SHA3-384 hash: e736b52a6ae60e136766cbedd01b4104d6385c8d2c8cda383b1a342f7efbdf1ff3df665647517d1033664f0ab77a7049
SHA1 hash: 7f9cbdac02ec5a35b7e70ba234eafcbfd9558b50
MD5 hash: 098b0fce4e52a2dfb1174d9828680633
humanhash: california-beryllium-neptune-mobile
File name:z.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:39'405'568 bytes
First seen:2025-10-12 17:50:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'246 x AgentTesla, 20'506 x Formbook, 12'374 x SnakeKeylogger)
ssdeep 786432:By1kRqcED//5lKz8PcVAgJS6Rckjw/SJ26fQ4nGh:BZyr/5lKz8PcVjLjw/82DcG
TLSH T10587AC7310D59BA268188C2D76DA7D59BD46BC02C948D9B0B2C75C9EBE443B36F2CB13
TrID 75.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.9% (.EXE) Win64 Executable (generic) (10522/11/4)
4.6% (.EXE) Win32 Executable (generic) (4504/4/1)
2.1% (.ICL) Windows Icons Library (generic) (2059/9)
2.1% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:exe xworm


Avatar
abuse_ch
XWorm C2:
192.169.69.26:8887

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
192.169.69.26:8887 https://threatfox.abuse.ch/ioc/1612970/
8.208.101.138:10272 https://threatfox.abuse.ch/ioc/1612972/

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
z.exe
Verdict:
Malicious activity
Analysis date:
2025-10-12 15:50:08 UTC
Tags:
evasion auto-startup auto xworm rat asyncrat arch-scr arch-exec telegram httpdebugger tool njrat remote amadey botnet github loader auto-sch lumma stealer reverseloader python auto-sch-xml crypto-regex anti-evasion uac mirai purehvnc payload quasar generic stealc ipfs phishing massbass websocket metasploit backdoor smb cobaltstrike meterpreter
Link:
https://app.any.run/tasks/0d561968-ae3f-492c-b760-932dd21529b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ebce31f2ca2f143e41bba4
Tags:
autorun shell spawn sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Creating a file in the %AppData% directory
Creating a window
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Creating a file
Connecting to a non-recommended domain
Connection attempt
Launching a service
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Connection attempt to an infection source
Query of malicious DNS domain
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/68ebea6d71883144ef32f240/reports/812ba44a-1d31-452a-859e-b33e8be726bc/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/76f71c718f9238d746ac3ad7f80e8d69e5e853eb5c3afbb0ab2550212093de1d
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-12T12:52:00Z UTC
Last seen:
2025-10-14T08:54:00Z UTC
Hits:
~1000
Detections:
Trojan.MSIL.Agent.sba HEUR:Trojan.MSIL.Shellcode.gen Backdoor.MSIL.XWorm.evl Trojan.Agent.UDP.C&C Trojan.Agent.HTTP.C&C Trojan.Win32.Memz.k HEUR:Backdoor.MSIL.Convagent.gen Backdoor.MSIL.XWorm.c HEUR:Exploit.Script.Blocker.U Trojan-Spy.Win64.Agent.sb Trojan.MSIL.Agent.sb HEUR:Trojan.MSIL.Taskun.sb Backdoor.MSIL.XWorm.b Trojan-PSW.Mimikatz.TCP.C&C Trojan-PSW.Lumma.HTTP.Download Trojan.Win32.Yakes.sb Trojan.Agentb.TCP.C&C HEUR:Trojan.MSIL.Taskun.gen Trojan.Patched.HTTP.ServerRequest Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.b MEM:Trojan.Win64.Shellcode.gen VHO:Backdoor.Win32.Agent.gen Trojan.Win32.Vimditator.sb Trojan.Win32.Delf.sb Backdoor.XWorm.HTTP.C&C Trojan-Spy.Stealer.HTTP.C&C Backdoor.Agent.HTTP.C&C Trojan.Win32.Quasar.sb HEUR:Trojan.MSIL.APosT.gen Trojan-PSW.Stealerc.HTTP.ServerRequest PDM:Trojan.Win32.Generic HEUR:Backdoor.MSIL.XClient.a Trojan-Downloader.Tiny.HTTP.Download Backdoor.Win32.Androm Trojan-Dropper.Win32.Injector HEUR:Trojan.MSIL.Inject.gen VHO:Backdoor.Win32.Convagent.gen Trojan-PSW.MSIL.Agent.sb HEUR:Trojan-Dropper.MSIL.Dapato.gen HEUR:Backdoor.MSIL.XWorm.gen Trojan-PSW.Win32.Xploder.sb Trojan-Dropper.Win32.Injector.sb Trojan.Win32.Eb.b Trojan.Win32.Agent.sb HEUR:Trojan.BAT.Obfus.gen Trojan-Downloader.Agent.TCP.C&C Backdoor.Win32.Remcos.sb HEUR:Backdoor.MSIL.XClient.b Trojan-Ransom.Cryptodef.HTTP.C&C HEUR:Trojan.MSIL.Crypt.gen HEUR:Trojan.MSIL.Agent.gen VHO:Worm.Win32.AutoRun.gen Backdoor.XClient.HTTP.C&C Trojan.Win32.Penguish.sbd Trojan.Win32.Stelpak.sb Trojan.Win64.Agent.smekab Trojan.MSIL.Inject.c HEUR:Trojan.Win32.Stelpak.gen HEUR:Trojan.BAT.Tesre.gen HEUR:Backdoor.MSIL.Agent.gen Trojan-PSW.Stealerc.HTTP.C&C Trojan-PSW.MSIL.Reline.sb Backdoor.Win32.Remcos.e Backdoor.Androm.HTTP.Download VHO:Worm.Win32.Convagent.gen PDM:Worm.Win32.Generic HEUR:Trojan.Script.Generic Backdoor.MSIL.Agent.sb Trojan.Win64.Agentb.sb Trojan-Downloader.SLoad.HTTP.C&C Trojan-Downloader.Agent.HTTP.C&C Trojan.JS.SAgent.sb Backdoor.Agent.TCP.C&C Trojan.Win32.Inject.sb HEUR:Trojan-Downloader.Script.Generic Trojan.Win32.PoverTel.sb Backdoor.Win32.Remcos.f Trojan.MSIL.Inject.sb HEUR:Trojan.Win32.Generic Trojan-Downloader.Dupzom.HTTP.Download HEUR:Trojan.Multi.Donut.b Trojan.MSIL.Donut.sb Virus.Win32.Sality.sil HEUR:Trojan.MSIL.Quasar.gen Trojan-Spy.Stealer.HTTP.ServerRequest Trojan-PSW.MSIL.Mercurial.sb Trojan.Win32.DiskWriter.sj VHO:Trojan-PSW.Win32.Vidar.gen Trojan-Spy.MSIL.KeyLogger.sb Trojan-Downloader.PsDownload.HTTP.C&C Trojan.Agent.TCP.C&C Trojan.Win32.Shellcode.sb Trojan.Win32.Packed.sb Trojan-Banker.MSIL.ClipBanker.sb HEUR:Exploit.Win32.BypassUAC.b Backdoor.Farfli.TCP.C&C VHO:Backdoor.MSIL.XClient.gen Trojan.Win32.AutoRun.gen Trojan.Agentb.UDP.C&C HEUR:Trojan-PSW.MSIL.Agensla.gen HEUR:Trojan.MSIL.Dnoper.gen Trojan-Downloader.Farfli.HTTP.C&C Trojan.Scar.UDP.C&C HEUR:Trojan.MSIL.Injector.gen PDM:Trojan.Win32.Tasker.cust HEUR:Trojan-Spy.MSIL.Agent.sb Backdoor.MSIL.XWorm.a Trojan-Ransom.Snocry.HTTP.C&C Backdoor.MSIL.Crysan.d Trojan-Downloader.VB.HTTP.Download Trojan.Yakes.HTTP.ServerRequest Trojan.MSIL.Miner.sb HEUR:Trojan-Spy.MSIL.Noon.gen Trojan-Downloader.Stralo.HTTP.C&C Trojan.Win32.Agent.rnd Trojan.MSIL.Dnoper.sb HEUR:Trojan-PSW.MSIL.Azorult.gen HEUR:Trojan.Win32.Agent.ckt Trojan-Dropper.Win32.Agent.sb Backdoor.MSIL.VenomRAT.a Trojan.Win32.Penguish.sb Trojan-PSW.Win32.Stealerc.rdl HEUR:Trojan.Win32.Stelpak.pef Trojan-Banker.ChePro.HTTP.ServerRequest Trojan-Downloader.Win32.Deyma.sb Trojan-Downloader.Tiny.HTTP.C&C Trojan-PSW.Win32.Stealer.sb HEUR:Trojan.MSIL.Eb.gen Trojan.Shellcode.TCP.C&C Trojan.Win32.Ekstak.sb Exploit.Win32.BypassUAC.sb VHO:Backdoor.MSIL.Crysan.gen Backdoor.Agent.UDP.C&C HEUR:Trojan.Win64.CobaltStrike.gen HEUR:Trojan.Multi.Generic Trojan.Snojan.HTTP.C&C Trojan.MSIL.Quasar.a UDS:DangerousObject.Multi.Generic Trojan.MSIL.Crypt.sb HEUR:Trojan-Banker.MSIL.ClipBanker.gen HEUR:Trojan.MSIL.Scarsi.gen HEUR:Trojan.MSIL.PowerShell.gen HEUR:Backdoor.MSIL.Crysan.gen Trojan.VBS.Runner.sb BSS:Trojan.Win32.Generic Trojan.Win32.Eb.a Packed.Win32.Salpack.e Trojan-Spy.Quasar.HTTP.ServerRequest Trojan-PSW.Stealer.TCP.C&C Trojan.Win32.Strab.sb Trojan-Banker.Win32.Express.sb HEUR:Trojan.Win32.Injuke.gen HEUR:Backdoor.MSIL.XClient.gen Trojan-PSW.PureLogs.TCP.C&C Trojan.Scar.HTTP.C&C HEUR:Trojan.Win64.Donut.a Downloader.Snojan.HTTP.C&C NetTool.Ngrok.UDP.C&C NetTool.AWSListS3Buckets.HTTP.C&C Downloader.Snojan.HTTP.ServerRequest RemoteAdmin.NetSup.HTTP.C&C RemoteAdmin.NetSup.UDP.C&C
Link:
https://opentip.kaspersky.com/76f71c718f9238d746ac3ad7f80e8d69e5e853eb5c3afbb0ab2550212093de1d/results?tab=lookup
Result
Threat name:
Amadey, AsyncRAT, KeyLogger, Stealc, Vid
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1793615
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Changes memory attributes in foreign processes to executable or writable
Contains functionality to log keystrokes (.Net Source)
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Drops PE files to the user root directory
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected Amadeys Clipper DLL
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected Keylogger Generic
Yara detected Stealc
Yara detected Telegram RAT
Yara detected Telegram Recon
Yara detected Vidar stealer
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1793615 Sample: z.exe Startdate: 12/10/2025 Architecture: WINDOWS Score: 100 98 Found malware configuration 2->98 100 Malicious sample detected (through community Yara rule) 2->100 102 Antivirus detection for dropped file 2->102 104 27 other signatures 2->104 8 z.exe 23 81 2->8         started        12 OpenWith.exe 2->12         started        14 OpenWith.exe 2->14         started        16 3 other processes 2->16 process3 file4 78 f03cc966d2abcece5e...9187821f3188012d992, PE32 8->78 dropped 80 C:\Users\user\AppData\Local\Temp\eqtrn.exe, PE32 8->80 dropped 82 d08846cf35cb56da56...78b61c483bd0cf7fd3e, PE32+ 8->82 dropped 84 61 other malicious files 8->84 dropped 130 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 8->130 18 1e.exe 8->18         started        22 2B718102533B04A95D1FA95CE3B76B2A.exe 8->22         started        25 0cdb412100c21a6ba8c9da13ff3c7f2a.exe 8->25         started        27 21 other processes 8->27 signatures5 process6 dnsIp7 62 C:\Users\user\AppData\Roaming\waukz4l1.exe, PE32 18->62 dropped 106 Antivirus detection for dropped file 18->106 108 Multi AV Scanner detection for dropped file 18->108 110 Changes memory attributes in foreign processes to executable or writable 18->110 126 3 other signatures 18->126 29 powershell.exe 18->29         started        88 196.251.71.73 Web4AfricaZA Seychelles 22->88 64 C:\Users\Public\ZM RAT, PE32 22->64 dropped 112 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 22->112 114 Protects its processes via BreakOnTermination flag 22->114 116 Creates multiple autostart registry keys 22->116 32 powershell.exe 22->32         started        90 91.92.242.128 THEZONEBG Bulgaria 25->90 66 C:\Users\user\...\SecurityHealthSystray.exe, PE32 25->66 dropped 118 Adds a directory exclusion to Windows Defender 25->118 34 powershell.exe 25->34         started        92 196.251.70.152 Web4AfricaZA Seychelles 27->92 94 196.251.70.87 Web4AfricaZA Seychelles 27->94 96 8 other IPs or domains 27->96 68 C:\Users\user\SystemInterrupt, PE32 27->68 dropped 70 C:\Users\user\AppData\...\jQIvRTNRxcLDya.exe, PE32 27->70 dropped 72 C:\Users\user\...\XWormClientFresh.exe, PE32 27->72 dropped 74 3 other malicious files 27->74 dropped 120 Bypasses PowerShell execution policy 27->120 122 Drops PE files to the user root directory 27->122 124 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 27->124 128 5 other signatures 27->128 36 MSBuild.exe 27->36         started        40 powershell.exe 27->40         started        42 powershell.exe 27->42         started        44 4 other processes 27->44 file8 signatures9 process10 dnsIp11 46 conhost.exe 29->46         started        48 conhost.exe 32->48         started        50 conhost.exe 34->50         started        86 160.191.245.154 SINET-ASResearchOrganizationofInformationandSystemsN unknown 36->86 76 C:\Users\user\AppData\Roaming\Client.exe, PE32 36->76 dropped 132 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 36->132 134 Creates multiple autostart registry keys 36->134 136 Loading BitLocker PowerShell Module 40->136 52 conhost.exe 40->52         started        54 conhost.exe 42->54         started        56 conhost.exe 44->56         started        58 conhost.exe 44->58         started        60 conhost.exe 44->60         started        file12 signatures13 process14
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/76f71c718f9238d746ac3ad7f80e8d69e5e853eb5c3afbb0ab2550212093de1d
Gathering data
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/76f71c718f9238d746ac3ad7f80e8d69e5e853eb5c3afbb0ab2550212093de1d
Threat name:
ByteCode-MSIL.Spyware.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2025-10-12 11:00:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
148
AV detection:
28 of 38 (73.68%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o33ry4mpsi4norvmhll7qdunnhs6qu7llq5pxmflevicciet3yoq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
error
XWorm
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:darktortilla family:donutloader family:quasar family:vidar family:xworm botnet:ratted botnet:runtimebroker crypter defense_evasion execution loader persistence pyinstaller ransomware rat spyware stealer trojan upx
Link:
https://tria.ge/reports/251012-wez76aywe1/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Opens file in notepad (likely ransom note)
Modifies registry class
Program crash
Enumerates physical storage devices
Detects Pyinstaller
Command and Scripting Interpreter: JavaScript
UPX packed file
AutoIT Executable
Obfuscated Files or Information: Command Obfuscation
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Downloads MZ/PE file
Command and Scripting Interpreter: PowerShell
Xworm family
Xworm
Vidar family
Vidar
Quasar payload
Quasar family
Quasar RAT
Donutloader family
DonutLoader
Detects Vidar Stealer
Detects DonutLoader
Detects Darktortilla crypter.
Detect Xworm Payload
Detect Vidar Stealer
Darktortilla family
Darktortilla
Malware Config
C2 Extraction:
45.145.225.144:6000
172.245.106.45:1122
xxxxz-61067.portmap.host:61067
omnizplsr-22653.portmap.host:22653
remdefrem.duckdns.org:1515
:1515
188.240.81.202:1607
13.62.18.15:1607
refrech.duckdns.org:7777
196.251.71.73:1177
rockyx22.duckdns.org:8887
1.tcp.sa.ngrok.io:21424
77.100.63.251:5631
taxlogs.linkpc.net:7000
premiemclient-4570.work.gd:7000
petro4prime.ydns.eu:5909
107.175.214.47:5555
OAjoWtc1G9RInLp0gJZzfw==:33
196.251.70.87:2799
91.92.242.128:7000
sigmaratohio-52009.portmap.host:55615
faris552-36484.portmap.host:36484
82.24.40.117:7000
170.205.31.12:4886
ddnsservice01.theworkpc.com:7000
185.209.20.25:443
185.196.10.190:8000
45.88.9.209:5063
epicskillforge.com:443
wealthyblessed.minhaempresa.tv:3033
exim111.casacam.net:7978
88.218.17.152:7978
bore.pub:3977
160.238.13.158:30121
191.96.225.192:8080
winservicesconsole.duckdns.org:7001
103.245.164.58:5045
192.159.99.205:7000
xworm7000.duckdns.org:7000
172.111.136.37:6000
196.251.70.152:5000
unknownhk1.duckdns.org:8080
96.44.154.196:7000
154.12.89.173:7000
refrech.duckdns.org:2805
duskesthostplug.duckdns.org:1111
nonoise.duckdns.org:6065
143.14.44.192:999
fuckrat.ru:1131
31.57.97.59:505
1.tcp.eu.cpolar.io:10272
82.26.74.222:162
W0rmLeFilou-26308.portmap.host:26308
176.97.210.95:6000
qrpn9be.localto.net:2810
localhost:4782
87.97.126.177:4782
91.92.242.148:1070
Dropper Extraction:
https://textbin.net/raw/xsi2eulwpw
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5da06b6c-4865-4ed6-9bbe-53d297caae96
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/76f71c718f92/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76f71c718f9238d746ac3ad7f80e8d69e5e853eb5c3afbb0ab2550212093de1d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Any_SU_Domain
Create hunting rule
Author:you
Description:Detect any reference to .su domains or subdomains
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Golang_Binary
Create hunting rule
Author:Andrew Morrow
Description:Detects binaries compiled with Go
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:EXE_RAT_XWorm_April2024
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_R77
Create hunting rule
Author:ditekSHen
Description:Detects r77 rootkit
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_PssCaptureSnapshot_Usage
Create hunting rule
Author:Dana Behling - Just me not for personal curiosity, no company.
Description:Detects binaries abusing PssCaptureSnapshot in combination with typical combination that indicates malicious activity.
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_Generic_MassHunt_Webshells_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic multi-language webshell mass-hunt rule (PHP/ASP(X)/JSP/Python/Perl/Node) - 2025
Reference:https://cyfare.net/
Rule name:Windows_Rootkit_R77_d0367e28
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit
Rule name:Windows_Trojan_XWorm_b7d6eaa8
Create hunting rule
Author:Elastic Security
Rule name:win_xworm_bytestring
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects bytestring present in unobfuscated xworm
Rule name:win_xworm_simple_strings
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects simple strings present in unobfuscated xworm
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments