MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac
SHA3-384 hash:	349d8630f517f38324e3f4d99fa5fe97fdc11c25ec13de9b1b9d3daa2b35f8b80a0b38d33208d77d1cf8aa0fbd009d5a
SHA1 hash:	e26b7d5bf5d6b0305408f100e45fc10aab7b4864
MD5 hash:	1b31dcc5e3e26dd06e7f64320d2cca97
humanhash:	maryland-snake-football-emma
File name:	yidxpq.bat
Download:	download sample
Signature	XWorm Create hunting rule
File size:	507 bytes
First seen:	2025-12-29 08:41:46 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	12:s80Qpc5InLgyaIS1PKC26wx0T8V45kJ00qo3unaXBXOVZ50H:xLw1PKC26mf4Yn3LkVi
Threatray	2'014 similar samples on MalwareBazaar
TLSH	T1F0F00513116DA3DC15D846F2012469A8432D67CB3A245D8D77F5CB8C8B8312855EF7C4
Magika	powershell
Reporter	abuse_ch
Tags:	bat xworm

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

_8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac.txt

Verdict:

Malicious activity

Analysis date:

2025-12-29 08:52:26 UTC

Tags:

xworm

Link:

https://app.any.run/tasks/f1037315-31ee-4b62-a44f-9682f1b8051a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/46449/

Detection(s):

SecuriteInfo.com.Heur.BZC.MNT.Boxter.830.7F401BA2.28127.8734.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69523ef57d915bf1778e9f2c

Tags:

ransomware asyncrat shell sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 powershell

Link:

https://www.filescan.io/uploads/69523eef09f6942c4fc63d1e/reports/c6b8889c-bc25-4f61-9660-adad5393e382/overview

Verdict:

Malicious

Labled as:

BZC.MNT.Boxter.830

Link:

https://www.hybrid-analysis.com/sample/8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac

Verdict:

Malicious

File Type:

ps1

First seen:

2025-12-28T11:11:00Z UTC

Last seen:

2025-12-30T03:23:00Z UTC

Hits:

~10

Detections:

Trojan.PowerShell.Strion.sb

Link:

https://opentip.kaspersky.com/8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1841299

Signature

Bypasses PowerShell execution policy

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powerup Write Hijack DLL

Suspicious powershell command line found

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac/

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac

Threat name:

Script-PowerShell.Backdoor.XWorm

Status:

Malicious

First seen:

2025-12-28 15:49:31 UTC

File Type:

Text (Batch)

AV detection:

7 of 36 (19.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rwhl7p6ftfki4fgz2owmnyfx5b5gggxusvupzppip5pn3pvnswwa._file

Verdict:

malicious

Label(s):

xworm

XWorm

2aec104448a89a67864309400abe1150eb739e21e852a8a2407d63f1f3f540ea

XWorm

44afc306bbc5d88a38f409b16593fd5046eddba21af7f4d43697b27cb421c298

XWorm

58f75e02032fb21bbd4bcc72ed18edd24b986b206e51e7ec57003eabdf2883a4

XWorm

error

XWorm

+ 2'004 additional samples on MalwareBazaar

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm execution rat trojan

Link:

https://tria.ge/reports/251229-kl6gzaa16b/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Badlisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

Malware family:

XWorm

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8d8ebfbfc599/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_PowerShell_Base64_Decode Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects PowerShell code to decode Base64 data. This can yield many FP

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)