MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 11

Intelligence 11 IOCs YARA 5 File information Comments

SHA256 hash:	89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406
SHA3-384 hash:	d541790cafd2382ff4111545afc88f963792efe5f92be57536aa923f28d507b966d8fd937be3dc6f2430474e96740940
SHA1 hash:	0504eb7a02880bada9ada9758612c06c7c7a2bc7
MD5 hash:	6168a105756bf19e51f199de31a987b2
humanhash:	skylark-mike-robert-table
File name:	loader.ps1
Download:	download sample
Signature	XWorm Create hunting rule
File size:	68'126 bytes
First seen:	2026-03-19 13:58:44 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	1536:bWK5Mqlue2FVIanQwEI9Wuxn+sliaZLu0eFT4Tj49Yun:KDqQe2FVjQwL9lTliasdAoYun
Threatray	65 similar samples on MalwareBazaar
TLSH	T15B630125239E58F930F1D824B99A9B1CEA3850376C557C59B3E1E3B06FD314631B0E6B
Magika	powershell
Reporter	ShadowOpCode
Tags:	69-61-36-229 ps1 xworm

Intelligence

File Origin

# of uploads :

# of downloads :

152

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69bc012f93b644ca466baf23

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

base64 encrypted obfuscated powershell

Link:

https://www.filescan.io/uploads/69bc012e4ec2f522cc4f5114/reports/ecddd1e1-0f1a-417d-84d1-8cb371a98e70/overview

Verdict:

Malicious

Labled as:

PowerShell/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406

Verdict:

Malicious

File Type:

ps1

Detections:

Trojan.Win32.HTA.a PDM:Trojan.Win32.Generic Backdoor.Agent.TCP.C&C

Link:

https://opentip.kaspersky.com/89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406/results?tab=lookup

Score:

87%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406/

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406

Threat name:

Script-PowerShell.Trojan.Boxter

Status:

Malicious

First seen:

2026-03-19 13:59:12 UTC

File Type:

Text (PowerShell)

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rhqaocxpsbsllt3q52wars7akrtmtdtsxytxaahe3xrlhj4fsqda._file

Result

Malware family:

xworm

Score:

10/10

Tags:

family:donutloader family:xworm collection defense_evasion execution loader pyinstaller rat spyware stealer trojan upx

Link:

https://tria.ge/reports/260319-ragsssav51/

Behaviour

Kills process with taskkill

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: PowerShell

Detects Pyinstaller

UPX packed file

Accesses Microsoft Outlook profiles

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Detect Xworm Payload

Detects DonutLoader

DonutLoader

Donutloader family

Xworm

Xworm family

Malware Config

C2 Extraction:

69.61.36.229:2080
mTattmrvqnSB2jtWg1xeUQ==:23

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)