🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87eac01e72b2d60782dc5db8a94ac36bff86742db78bd580ce3d2bc1444cf408. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87eac01e72b2d60782dc5db8a94ac36bff86742db78bd580ce3d2bc1444cf408
SHA3-384 hash: b384a3120535d7399adac8acf841f3456922deec24f535412ebb8f3e2814a5e17d90d1361a2647554590d36e4acb26b3
SHA1 hash: 178fc7144d7bf91bf0cfe56863582dff4a173c0a
MD5 hash: 937ea36238a363bbcd30c1ab05a63679
humanhash: ohio-virginia-floor-victor
File name:ordenXdeXcompra.rar
Download: download sample
Signature XWorm
Create hunting rule
File size:82'195 bytes
First seen:2026-05-20 17:05:01 UTC
Last seen:2026-05-20 17:55:11 UTC
File type: rar
MIME type:application/x-rar
ssdeep 1536:nDwwawzFKy7pi/7TDigLyM3QQ6JMNJFTMFdN94mawcjdlDwQbBrp:nb7qTDZLyeZ6JQTAam5c2Qb9p
TLSH T1E28302A2419A1A2D5466C1AFFCE026FBA2F765C073513DF4E12D227D8053FAC2F5681E
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter TomU
Tags:rar xworm

Intelligence

File Origin
# of uploads :
2
# of downloads :
45
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:val.vbs
File size:279'132 bytes
SHA256 hash: ad925bc485fb6fa119d5479f42e54555e84c20ab77a6b7641cda4532047c2789
MD5 hash: 3c0128438de204b0b4492dda4a3c6d76
MIME type:text/plain
Signature XWorm
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/779e8014-872a-40d1-a3c3-1167678a41ae/
Detection(s):
SecuriteInfo.com.Script.SNH-gen.98874795.UNOFFICIAL
Create hunting rule

YARA.SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0dee594159ce11f601cf05
Tags:
xtreme virus shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aes anti-vm base64 base64 cmd crypto evasive fingerprint lolbin obfuscated packed powershell powershell
Link:
https://www.filescan.io/uploads/6a0decf478f38c56ac73f0f0/reports/94e8d2af-780e-4de1-89e1-adef7ca80e62/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/87eac01e72b2d60782dc5db8a94ac36bff86742db78bd580ce3d2bc1444cf408
Verdict:
Malicious
File Type:
rar
First seen:
2025-11-18T12:20:00Z UTC
Last seen:
2026-05-20T05:33:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/87eac01e72b2d60782dc5db8a94ac36bff86742db78bd580ce3d2bc1444cf408/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87eac01e72b2d60782dc5db8a94ac36bff86742db78bd580ce3d2bc1444cf408/
Threat name:
Script-WScript.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2025-11-18 09:55:46 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/87eac01e72b2d60782dc5db8a94ac36bff86742db78bd580ce3d2bc1444cf408

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

rar 87eac01e72b2d60782dc5db8a94ac36bff86742db78bd580ce3d2bc1444cf408

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments