MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f
SHA3-384 hash: aa0715fd72af3bdf61abd352500b89533e0d97d2e6ffad8298ebecb0cd5914b2d94eb0260d012b9ef7d4d2ce5030d42e
SHA1 hash: 012f513cc16a1c1f3e8cd03a80ceb4ab0d3b595b
MD5 hash: 77abe7f94a9edc8aa844946a7465a692
humanhash: pennsylvania-romeo-diet-eighteen
File name:NEW-Order-2025-06-25-pdf.bat
Download: download sample
Signature XWorm
Create hunting rule
File size:523'264 bytes
First seen:2025-06-26 09:54:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:i1a1/nkJsly69ihPm9I9+Yyocy00uso+AG:PFkJslyGsm90+n0Q+J
TLSH T1C9B4F11862A6EF51D9AD0BF80921E13113F6ADDEA816D3074FDAFCFBB8103583591687
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:exe xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
470
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NEW-Order-2025-06-25-pdf.bat
Verdict:
Malicious activity
Analysis date:
2025-06-26 09:55:33 UTC
Tags:
netreactor remote xworm stealer
Link:
https://app.any.run/tasks/74327e9a-01ea-44bf-b928-207f05a3e163

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11221/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3357.17981.17221.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685d1922b06783b9ebd7fd5e
Tags:
spawn shell remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Connection attempt
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
entropy masquerade obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/685d191fc4a908e875dbbe15/reports/ad3d6a88-3f1b-4546-a873-be0473dca2c0/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f9c8e9a2-6b67-44d1-bc82-726a704e7e1d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f/
Threat name:
ByteCode-MSIL.Trojan.VIPKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-06-26 03:04:40 UTC
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pcn4qgy62z4c5kbjlua2hc2oa4wje5gtnq2zv2jwc46xrjfznixq._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:stormkitty family:xworm discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/250626-lx49qa1sfw/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
StormKitty
StormKitty payload
Stormkitty family
Xworm
Xworm family
Malware Config
C2 Extraction:
196.251.66.225:7000
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f7502208-7147-4427-b2d9-070a6016cc96
Unpacked files
SH256 hash:
789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f
MD5 hash:
77abe7f94a9edc8aa844946a7465a692
SHA1 hash:
012f513cc16a1c1f3e8cd03a80ceb4ab0d3b595b
Link:
https://www.unpac.me/results/d02d8443-a4bf-48ce-beda-36f50da3b9fd/
SH256 hash:
2b742c3f9f2aa5504fab6a4a12bd1e7a1c58569a6f683ae41daf2f450c89e2b1
MD5 hash:
f5ee67ec178857962707c1216592f129
SHA1 hash:
3ab332a30ceea85eccad8c81951c8fab71a9a190
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/d02d8443-a4bf-48ce-beda-36f50da3b9fd/
Parent samples :
1077313e39d5064c18f7c544fef3c9e53b35ec2c80bc406ded414d645e74649d
54a8b4c753e22ebf0f248088c4424393f31417b9d79e0dafe7bf573e6263240a
789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f
ed676622e67bd5910806983cc6a0950c4cf5e32a705ef5b221c55422afca467a
17d70d796220ac7bef6a22366d01799a94ac7d2e71f8d7fc5e591e02763ed04d
SH256 hash:
c34c0ec0e83ab079d26dcdd16b184d2a3c8af097d55eea61b707c4388495316f
MD5 hash:
2c04e7025a40b56037a8985ea56ab420
SHA1 hash:
402d5a0ed82ae519a602215f9fec7578a2acf7dd
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d02d8443-a4bf-48ce-beda-36f50da3b9fd/
SH256 hash:
78046f4561edec1c58cb2c2f90340290ca4757786a5e218fd1e9b36777a06da0
MD5 hash:
6de5e23ef836152bf7d186ae3f4e0fad
SHA1 hash:
5e96617e1e639382cd6316376a7be504aa45238a
Detections:
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
win_mal_XWorm
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
MALWARE_Win_AsyncRAT
Create hunting rule
MALWARE_Win_XWorm
Create hunting rule
Link:
https://www.unpac.me/results/d02d8443-a4bf-48ce-beda-36f50da3b9fd/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/789bc81b1ed6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Executable exe 789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/11221/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments