MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c7dcb164544b81ecbd5c3b6509ae9bf4a83762d9d97f8ea611eb495c8188619. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c7dcb164544b81ecbd5c3b6509ae9bf4a83762d9d97f8ea611eb495c8188619
SHA3-384 hash: 939a2f46e3a8a0a75222390f86b23dbfed66131eb4e6a7d04edbb01319747e6f3d5f486f7b47c87c5cb09f15dcc1599a
SHA1 hash: 38ea077dd7e379c5a1db610f9218327a721f557d
MD5 hash: 3fb3b01f48ca60358978f6acd7910168
humanhash: minnesota-winter-mike-bakerloo
File name:Factura0987623.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:694'272 bytes
First seen:2025-07-02 08:01:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 21371b611d91188d602926b15db6bd48 (61 x Formbook, 23 x AgentTesla, 20 x RemcosRAT)
ssdeep 12288:mz7hU5I5yuNHIgzSFKxWltRohBfSTso93Ue3jY50NJf:mf+iN57Gtene3d3dj
TLSH T1CBE4EF366C33A000FEFDC1307CD0B79141283ABEACDA0F86E559B6D67AB72E45671165
TrID 39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6)
38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon 66c29abaaaaaaa86 (20 x AgentTesla, 10 x Formbook, 7 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe xworm


Avatar
abuse_ch
XWorm C2:
198.12.126.169:8780

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
198.12.126.169:8780 https://threatfox.abuse.ch/ioc/1551569/

Intelligence

File Origin
# of uploads :
1
# of downloads :
15
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11959/
Detection(s):
SecuriteInfo.com.Trojan.AutoIt.1678.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6864e794c9eb9747376552bd
Tags:
autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Launching a process
Сreating synchronization primitives
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Connection attempt
Using the Windows Management Instrumentation requests
Creating a file in the mass storage device
Enabling autorun by creating a file
Unauthorized injection to a system process
Adding an exclusion to Microsoft Defender
Enabling threat expansion on mass storage devices
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/8c7dcb164544b81ecbd5c3b6509ae9bf4a83762d9d97f8ea611eb495c8188619
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/db89bac0-7521-4cbf-9679-74e176e0964e
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1727011
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Drops VBS files to the startup folder
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1727011 Sample: Factura0987623.exe Startdate: 02/07/2025 Architecture: WINDOWS Score: 100 59 Suricata IDS alerts for network traffic 2->59 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 12 other signatures 2->65 9 Factura0987623.exe 4 2->9         started        13 wscript.exe 1 2->13         started        process3 file4 41 C:\Users\user\AppData\...\exhilaratingly.exe, PE32 9->41 dropped 73 Binary is likely a compiled AutoIt script file 9->73 15 exhilaratingly.exe 2 9->15         started        75 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->75 19 exhilaratingly.exe 1 13->19         started        signatures5 process6 file7 43 C:\Users\user\AppData\...\exhilaratingly.vbs, data 15->43 dropped 47 Multi AV Scanner detection for dropped file 15->47 49 Binary is likely a compiled AutoIt script file 15->49 51 Drops VBS files to the startup folder 15->51 53 Switches to a custom stack to bypass stack traces 15->53 21 RegSvcs.exe 2 4 15->21         started        55 Writes to foreign memory regions 19->55 57 Maps a DLL or memory area into another process 19->57 26 RegSvcs.exe 1 19->26         started        signatures8 process9 dnsIp10 45 198.12.126.169, 49691, 8780 AS-COLOCROSSINGUS United States 21->45 39 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 21->39 dropped 67 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->67 69 Bypasses PowerShell execution policy 21->69 71 Adds a directory exclusion to Windows Defender 21->71 28 powershell.exe 23 21->28         started        31 powershell.exe 23 21->31         started        33 WerFault.exe 21->33         started        file11 signatures12 process13 signatures14 77 Loading BitLocker PowerShell Module 28->77 35 conhost.exe 28->35         started        37 conhost.exe 31->37         started        process15
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8c7dcb164544b81ecbd5c3b6509ae9bf4a83762d9d97f8ea611eb495c8188619
Verdict:
Malware
YARA:
5 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/3fb3b01f48ca60358978f6acd7910168
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8c7dcb164544b81ecbd5c3b6509ae9bf4a83762d9d97f8ea611eb495c8188619/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-06-30 15:02:24 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rr64wfsfis4b5s6vyo3fbgxjx5fig5rntwl7r2tbd22jlsayqymq._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm collection discovery execution rat trojan upx
Link:
https://tria.ge/reports/250702-jw61tavkz3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Accesses Microsoft Outlook profiles
Drops startup file
Executes dropped EXE
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d41a0018-b522-44d9-b186-3fd9c6f2f2c1
Unpacked files
SH256 hash:
8c7dcb164544b81ecbd5c3b6509ae9bf4a83762d9d97f8ea611eb495c8188619
MD5 hash:
3fb3b01f48ca60358978f6acd7910168
SHA1 hash:
38ea077dd7e379c5a1db610f9218327a721f557d
Link:
https://www.unpac.me/results/8219dc6f-9b7b-40da-889a-0e2789a29742/
SH256 hash:
aecae7e0ed070ddcb7cc92bed64e7790b4a3f3e341e8fc22308bf823b395d5ae
MD5 hash:
3d8f6fb026a442c8481710f06e8cbe41
SHA1 hash:
d9da2d8ce4092f1fe680fd05f2159b8a446f59a4
Detections:
win_xworm_w0
Create hunting rule
win_mal_XWorm
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
MALWARE_Win_AsyncRAT
Create hunting rule
MALWARE_Win_XWorm
Create hunting rule
Link:
https://www.unpac.me/results/8219dc6f-9b7b-40da-889a-0e2789a29742/
Parent samples :
88170c9fa79e032ba011d0c8b8106e480bcb37985833a84cfe4263c778e421b6
8b2cc228b4a72f956d83e49583f0b4c80a1b3963c13a9ed942f545e08d5f3ac5
da23e4e01098ea352b7d8767ec68e715ec0aec368da768796b43560b37775ea4
8c7dcb164544b81ecbd5c3b6509ae9bf4a83762d9d97f8ea611eb495c8188619
6022f226e68e690fa6cb1b54c57fbccf654c3d6880f1463943f4d42214e38de7
SH256 hash:
a1c0c4a10324dee2f9b6cea850bec181957f16ee7f995f099883577e4e9973d9
MD5 hash:
8e70d4adf358da10afff26f62187cc37
SHA1 hash:
e5cb2bc0965a55e6ed53aee1ea576297d38cdc34
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/8219dc6f-9b7b-40da-889a-0e2789a29742/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8c7dcb164544b81ecbd5c3b6509ae9bf4a83762d9d97f8ea611eb495c8188619

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/11959/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments