MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50
SHA3-384 hash: 0e676d560b5f3f2de7ede9b59b8814c93a288bb3e3769005f04927ac5b1536a928681965779660fc6282f8044030f756
SHA1 hash: eb098a7be1e2d77e51737ef3d4e0982a72678932
MD5 hash: a29cdd33711a9b55456009a3b3016434
humanhash: nebraska-kilo-lima-jersey
File name:Angebotsanfrage_895097326100_Metallbau_Figge.bat
Download: download sample
Signature XWorm
Create hunting rule
File size:364'762 bytes
First seen:2025-09-24 07:16:02 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 3072:3222222PpFi2222222222229b222222PpFi222222222222W222222PpFi22222h:vUzfbr4YQoyu
Threatray 2'417 similar samples on MalwareBazaar
TLSH T161745B21FC2B817AB6F5A5BC29BDC561FB37CABC10643E90F0106899069B41F3D66F94
Magika javascript
Reporter lowmal3
Tags:bat xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50.txt
Verdict:
No threats detected
Analysis date:
2025-09-24 07:17:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c43f1430-465d-4c98-bd93-fc2a7e056d50

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28753/
Detection(s):
SecuriteInfo.com.PUA.JS.Shell-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d53e0dcc9425144151ccaa
Tags:
dropper virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm base64 cscript evasive findstr fingerprint lolbin obfuscated obfuscated powershell wmic wscript
Link:
https://www.filescan.io/uploads/68d39ade58f24ea0d22a9a34/reports/14092662-922c-4d7e-b8a3-1ccc59566171/overview
Verdict:
Malicious
Labled as:
Trojan_Script_Wacatac_B_ml
Link:
https://www.hybrid-analysis.com/sample/7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50
Verdict:
Clean
File Type:
wsf
First seen:
2025-09-22T19:00:00Z UTC
Last seen:
2025-09-22T19:00:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1783091
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found malware configuration
Found Tor onion address
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1783091 Sample: Angebotsanfrage_89509732610... Startdate: 24/09/2025 Architecture: WINDOWS Score: 100 28 maintainthefeex.duckdns.org 2->28 30 osonsgroup.com 2->30 32 archive.org 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 50 12 other signatures 2->50 9 cmd.exe 1 2->9         started        signatures3 48 Uses dynamic DNS services 28->48 process4 signatures5 52 Suspicious powershell command line found 9->52 54 Bypasses PowerShell execution policy 9->54 12 powershell.exe 14 15 9->12         started        16 conhost.exe 9->16         started        process6 dnsIp7 36 osonsgroup.com 91.234.194.20, 443, 49688 RMI-FITECHFR France 12->36 38 archive.org 207.241.224.2, 49687, 80 INTERNET-ARCHIVEUS United States 12->38 56 Found Tor onion address 12->56 58 Writes to foreign memory regions 12->58 60 Injects a PE file into a foreign processes 12->60 18 CasPol.exe 12->18         started        21 CasPol.exe 4 12->21         started        24 conhost.exe 12->24         started        signatures8 process9 dnsIp10 40 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->40 34 maintainthefeex.duckdns.org 172.245.112.200, 49690, 9870 AS-COLOCROSSINGUS United States 21->34 26 WerFault.exe 20 16 21->26         started        signatures11 process12
Score:
84%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50
Threat name:
Script-BAT.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-09-23 07:45:03 UTC
File Type:
Text (Batch)
AV detection:
11 of 38 (28.95%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ppfuuttihksnlwzll5bycr3uf5hucy5msvzc44mce5znrft33nia._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
0cdbc8796b5a5adba8b361c2b13626b03c4b25975244bec36b6acf0dcde65352
XWorm
3b39da6b761aebfac6324138212fd5a6eeb89a50ef1e7b8f8a813c07ac920062
XWorm
41cdbafba89bad77d1784458e5c226eb405ca9f46bb65a38031c48a97e6eef84
XWorm
45ba32fcb65201e7cae3d05f77178e08fd41380624edd777e355c63ac1d126b7
XWorm
699b91f69cd0d059794175c55675ad931a2eaa18cb713523265429da6b021633
XWorm
error
XWorm
f03cc966d2abcece5e21a8c90cb2ae5472971202377c59187821f3188012d992
XWorm
+ 2'407 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution rat trojan
Link:
https://tria.ge/reports/250924-h31xpsdn71/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
fireblazecorrect.duckdns.org:9870
maintainthefeex.duckdns.org:9870
masqingtestformat.gleeze.com:9870
Dropper Extraction:
http://archive.org/download/optimized_MSI_PRO_with_b64/optimized_MSI_PRO_with_b64.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Batch (bat) bat 7bcb4a4e683aa4d5db2b5f438147742f4f4163ac95722e71822772d8967bdb50

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/28753/

Comments