MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2
SHA3-384 hash: 20d2ee92b83a074a966149ca98ba91253e74e76028bb9b4dd17d9c0c58daa737b7ea04f86dd452519efb3752c983990f
SHA1 hash: 895f9d400ff45be6c1f4549a5a19a0d18c0ede7a
MD5 hash: 03377164141262122f758569be27df77
humanhash: undress-grey-september-quiet
File name:03377164141262122f758569be27df77.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:2'688'000 bytes
First seen:2025-08-01 15:18:44 UTC
Last seen:2025-08-02 22:39:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 147a71fba2b52ee8ebd7b7cf32b9e1d5 (22 x LummaStealer, 2 x DarkCloud, 2 x Stealc)
ssdeep 49152:qf1nWgHSrSE3Vgyd01IK1qcMoE8HPBlmBXdnx0jTx0jC:W1n2rSEFgU01IU3PBlmd5xix3
Threatray 58 similar samples on MalwareBazaar
TLSH T1DAC5CF19E87890D7FCD301B17B699252A5237F3BDE2C69A790F487501249DEE063B23B
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe xworm

Intelligence

File Origin
# of uploads :
2
# of downloads :
55
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
E98D314FFC14986E942A010A29FDABE4.exe
Verdict:
Malicious activity
Analysis date:
2025-08-01 07:47:35 UTC
Tags:
amadey botnet stealer auto redline loader auto-reg lumma rdp auto-sch auto-startup autoit themida stealc telegram gcleaner qrcode xworm quasar rat evasion purelogs purecrypter
Link:
https://app.any.run/tasks/c9b864c2-b313-4594-98e7-c702055d94dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18326/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688cdb07af3050dc8d332ea3
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/688cdb0873b8ef6f4af9ebc8/reports/6999f9a3-d810-46d9-99be-44a697e0e4c1/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/31937a1e-4f17-4d47-91d4-e2db57310cf5
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1748563
Signature
.NET source code contains process injector
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Compiles code for process injection (via .Net compiler)
Creates a thread in another existing process (thread injection)
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Silenttrinity Stager Msbuild Activity
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Powershell decode and execute
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1748563 Sample: BFSqChU4uy.exe Startdate: 01/08/2025 Architecture: WINDOWS Score: 100 87 demo.softlinko.com 2->87 89 t.me 2->89 91 bg.microsoft.map.fastly.net 2->91 111 Suricata IDS alerts for network traffic 2->111 113 Malicious sample detected (through community Yara rule) 2->113 115 Multi AV Scanner detection for submitted file 2->115 117 8 other signatures 2->117 10 BFSqChU4uy.exe 2->10         started        13 svchost.exe 1 1 2->13         started        signatures3 process4 dnsIp5 125 Writes to foreign memory regions 10->125 127 Allocates memory in foreign processes 10->127 129 Injects a PE file into a foreign processes 10->129 16 MSBuild.exe 26 10->16         started        105 127.0.0.1 unknown unknown 13->105 signatures6 process7 dnsIp8 83 demo.softlinko.com 95.217.242.51, 443, 49682, 49683 HETZNER-ASDE Germany 16->83 85 t.me 149.154.167.99, 443, 49681 TELEGRAMRU United Kingdom 16->85 107 Encrypted powershell cmdline option found 16->107 109 Tries to harvest and steal browser information (history, passwords, etc) 16->109 20 powershell.exe 22 16->20         started        24 powershell.exe 16->24         started        26 powershell.exe 16->26         started        28 19 other processes 16->28 signatures9 process10 dnsIp11 65 C:\Users\user\AppData\...\tneoelkp.cmdline, Unicode 20->65 dropped 119 Writes to foreign memory regions 20->119 121 Compiles code for process injection (via .Net compiler) 20->121 123 Creates a thread in another existing process (thread injection) 20->123 31 csc.exe 3 20->31         started        34 conhost.exe 20->34         started        67 C:\Users\user\AppData\Local\...\seebzdfj.0.cs, Unicode 24->67 dropped 47 2 other processes 24->47 36 csc.exe 26->36         started        38 conhost.exe 26->38         started        103 192.168.2.7, 138, 443, 49503 unknown unknown 28->103 40 csc.exe 3 28->40         started        42 chrome.exe 28->42         started        45 chrome.exe 28->45         started        49 16 other processes 28->49 file12 signatures13 process14 dnsIp15 69 C:\Users\user\AppData\Local\...\tneoelkp.dll, PE32 31->69 dropped 51 cvtres.exe 1 31->51         started        71 C:\Users\user\AppData\Local\...\xaq23n0u.dll, PE32 36->71 dropped 53 cvtres.exe 36->53         started        73 C:\Users\user\AppData\Local\...\5yz4qbye.dll, PE32 40->73 dropped 55 cvtres.exe 40->55         started        93 www.google.com 142.251.40.132, 443, 49698, 49701 GOOGLEUS United States 42->93 95 142.250.80.36, 443, 49718, 49721 GOOGLEUS United States 45->95 75 C:\Users\user\AppData\Local\...\seebzdfj.dll, PE32 47->75 dropped 57 cvtres.exe 47->57         started        97 142.250.81.228, 443, 49788, 49789 GOOGLEUS United States 49->97 99 142.251.32.100, 443, 49758, 49759 GOOGLEUS United States 49->99 101 142.251.41.4, 443, 49747, 49750 GOOGLEUS United States 49->101 77 C:\Users\user\AppData\Local\...\v53ns2f5.dll, PE32 49->77 dropped 79 C:\Users\user\AppData\Local\...\urxxyyhu.dll, PE32 49->79 dropped 81 C:\Users\user\AppData\Local\...\3jljcztv.dll, PE32 49->81 dropped 59 cvtres.exe 49->59         started        61 cvtres.exe 49->61         started        63 cvtres.exe 49->63         started        file16 process17
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/03377164141262122f758569be27df77
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-08-01 11:27:33 UTC
File Type:
PE+ (Exe)
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p5smslhn5cbz5am4sxavdy7cjzaixgeiihojshr3ljmzmzfvpkza._file
Verdict:
malicious
Label(s):
vidar
Create hunting rule
Similar samples:
28c947039254699da4345db011064b691f933bb6019ae142c2592b4e275ab116
XWorm
37d589892a1896062373a4345281d67d904fbfb7db7019320b5faf97a499dd1e
XWorm
777e717f49cad153abf428496ab8393d33e5b69da1350b795d8b2610d37229e1
XWorm
9403483ce844b8392bc6e3251c206a23b08c107692e2a9e6639fb2c4aac9d818
XWorm
a4d203f4a05117415ff1896cd8971215c86321848e003fa83a00efd8b431d44c
XWorm
b75d16f3d805baf49792f7f39c7e4dbd27e2bf134b4519922a23a1bfb0afc092
XWorm
d7ab100eec217ae7edde5ad39ec0775e7ebca760ed758c63c412a6253de6a9d5
XWorm
error
XWorm
+ 48 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:lumma family:njrat family:quasar family:vidar family:xworm botnet:8208070b02ab19c5bccfbdc74ec6646e botnet:default botnet:hacked botnet:office04 credential_access defense_evasion discovery execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/250801-sqcz8azxds/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops autorun.inf file
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Looks up external IP address via web service
Obfuscated Files or Information: Command Obfuscation
Checks computer location settings
Drops startup file
Executes dropped EXE
Unsecured Credentials: Credentials In Files
Downloads MZ/PE file
Async RAT payload
AsyncRat
Asyncrat family
Detect Vidar Stealer
Detect Xworm Payload
Lumma Stealer, LummaC
Lumma family
Njrat family
Quasar RAT
Quasar family
Quasar payload
Vidar
Vidar family
Xworm
Xworm family
njRAT/Bladabindi
Malware Config
C2 Extraction:
https://t.me/dz25gz
https://steamcommunity.com/profiles/76561199880530249
66.63.187.164:8594
167.160.161.247:8594
66.63.187.164:8596
167.160.161.247:8596
167.160.161.247:8595
66.63.187.164:6666
167.160.161.247:6666
https://precisionbiomeds.com/ikg
https://mastwin.in/qsaz/api
https://physicianusepeptides.com/opu
https://vishneviyjazz.ru/neco/api
https://htsfhtdrjbyy1bgxbv.cfd/vcd
https://xurekodip.com/qpdl
https://utvp1.net/zkaj
https://orienderi.com/xori
Verdict:
Malicious
Tags:
Stealc
YARA:
n/a
Link:
https://app.threat.zone/submission/cd1cba58-73c7-49c1-af3a-3851454252f8
Unpacked files
SH256 hash:
7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2
MD5 hash:
03377164141262122f758569be27df77
SHA1 hash:
895f9d400ff45be6c1f4549a5a19a0d18c0ede7a
Link:
https://www.unpac.me/results/7a3e975f-8347-4ab4-a8c4-ef72ab44a01c/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7f64c92cede8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XWorm

Executable exe 7f64c92cede8839e819c95c151e3e24e408b988841dc991e3b5a599664b57ab2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3588297/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/18326/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateWindowExW

Comments