MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 87f1b3971bb5b44a760fe934c32c9364d1b417fb253da60bee93bf5569f7dc15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 17
| SHA256 hash: | 87f1b3971bb5b44a760fe934c32c9364d1b417fb253da60bee93bf5569f7dc15 |
|---|---|
| SHA3-384 hash: | 6c54e6b3440fe53dce0fcd56bd5c8e90882a301bd54b8d561e97f6b979e2f770524e244f25b4279d92b62ac568b2571f |
| SHA1 hash: | e5e5801cb3c307c9c2971e9b9063d1f5fe2b4f42 |
| MD5 hash: | 1e41a4c31bbdd0d192b65d9115c69596 |
| humanhash: | alanine-romeo-eighteen-saturn |
| File name: | 87f1b3971bb5b44a760fe934c32c9364d1b417fb253da60bee93bf5569f7dc15 |
| Download: | download sample |
| Signature | XWorm |
| File size: | 155'648 bytes |
| First seen: | 2026-09-04 12:13:06 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'218 x AgentTesla, 20'417 x Formbook, 12'370 x SnakeKeylogger) |
| ssdeep | 3072:tzIF0KJuyAXsbRota/g9J/yjgf6yFOBh98EpW6dr757:t0zuyAXsW8/g9Jqm6ysBXrN |
| TLSH | T110E36A82A7F80564FAF77B72BDB246609A377CCAA839D60D1608445D2B33E40DDB1727 |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | 2c2c2c0c2c2c2c2c (1 x Nitol, 1 x XWorm) |
| Reporter |  adrian__luca |
| Tags: | exe xworm |
Intelligence
File Origin
# of uploads :
1
# of downloads :
165
Origin country :
HUVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
87f1b3971bb5b44a760fe934c32c9364d1b417fb253da60bee93bf5569f7dc15
Verdict:
Malicious activity
Analysis date:
2026-09-04 12:11:48 UTC
Tags:
donutloader loader stealer telegram rat xworm
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a file in the %temp% subdirectories
Launching a process
Creating a process with a hidden window
Creating a file
Deleting a recently created file
Creating a file in the %AppData% directory
Creating a window
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
explorer installer-heuristic lolbin packed
Verdict:
Malicious
Labled as:
MSIL/ShellcodeRunner.JN trojan
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-31T13:34:00Z UTC
Last seen:
2026-09-02T08:34:00Z UTC
Hits:
~10
Malware family:
XWorm
Verdict:
Malicious
Score:
68%
Verdict:
Susipicious
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.19 Win 32 Exe x86
Threat name:
Win32.Trojan.Donut
Status:
Malicious
First seen:
2026-08-28 00:38:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
60
AV detection:
20 of 36 (55.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
DonutLoader
XWorm
Result
Malware family:
xworm
Score:
10/10
Tags:
family:donutloader family:xworm discovery loader persistence privilege_escalation rat trojan
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Detect Xworm Payload
Detects DonutLoader
Family: DonutLoader
Family: Xworm
Malware Config
C2 Extraction:
techycarterpiller.kozow.com:800
techycarterpiller.kozow.com:00800
techycarterpiller.kozow.com:00800
Unpacked files
SH256 hash:
87f1b3971bb5b44a760fe934c32c9364d1b417fb253da60bee93bf5569f7dc15
MD5 hash:
1e41a4c31bbdd0d192b65d9115c69596
SHA1 hash:
e5e5801cb3c307c9c2971e9b9063d1f5fe2b4f42
Detections:
triage_donut_ldr
SH256 hash:
742aae7fc262f9c3a9f89d54aa8533b63bf73b739bb97306ca19e4907cca68b4
MD5 hash:
4d49c762528a57106bcc2c8c75495b5d
SHA1 hash:
74ad1a5afc3f28ae700ae2e10bdf1c948a90c879
SH256 hash:
6e213d829038c48b6326ad1c5551f3877d7617ec71dbfc7ed83b6215796d1bb0
MD5 hash:
860f521c18ff54674703163a6b309d6c
SHA1 hash:
a4723841d8a478e1beeb0222675f3b4cafd33546
Detections:
win_xworm_a0
win_xworm_w0
XWorm
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
MALWARE_Win_AsyncRAT
MALWARE_Win_XWorm
win_mal_XWorm
win_xworm_bytestring
Malware family:
DonutLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Donutloader_f40e3759 |
|---|---|
| Author: | Elastic Security |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.