MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e8f5453c938c96bc1599782b134f57a1e897cc3d2813f8c162e7dafbf791dc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e8f5453c938c96bc1599782b134f57a1e897cc3d2813f8c162e7dafbf791dc9
SHA3-384 hash: 1d5fea825f1d166b57a4fa9ec9f807722affc0c6d37b61150672b7067b042de99f237cede29b0e7f87715940b9ef737b
SHA1 hash: 93304991bc2dc31f6f438b9ae09314597d83b764
MD5 hash: 8a6765a4608f98be5600adf08dd94378
humanhash: golf-may-six-wisconsin
File name:excelsetup.bat
Download: download sample
Signature XWorm
Create hunting rule
File size:1'048'576 bytes
First seen:2023-02-13 16:00:18 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 1536:n4tu7suXJSJPGow1adEjvjM1XAsKzBaRfy/Wr:4I7b5SJPGow1tvj2XAsKtaRGe
Threatray 104 similar samples on MalwareBazaar
TLSH T15A25E01783D1FA79C639B970CC2FAD499B004EF05E87ECD8B7A8A55A4D020ED4DE11A3
Reporter James_inthe_box
Tags:bat xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
excelsetup.bat
Verdict:
Malicious activity
Analysis date:
2023-02-13 16:01:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d82491e1-28a9-4201-9d1f-5d5a302237d9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/365165/
Detection(s):
Sanesecurity.Malware.28762.BatHeur.UNOFFICIAL
Create hunting rule

Txt.Downloader.OneNoteBAT-9986016-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63ea5ec097e87dd9097e81fc/reports/a9269396-90ad-4a67-a8e0-f46bf0fc7029/overview
Verdict:
Malicious
Labled as:
Txt.Downloader.OneNoteBAT
Link:
https://www.hybrid-analysis.com/sample/8e8f5453c938c96bc1599782b134f57a1e897cc3d2813f8c162e7dafbf791dc9
Result
Verdict:
UNKNOWN
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1173543
Signature
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Malicious sample detected (through community Yara rule)
Renames powershell.exe to bypass HIPS
Snort IDS alert for network traffic
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 806337 Sample: excelsetup.bat Startdate: 13/02/2023 Architecture: WINDOWS Score: 76 37 Snort IDS alert for network traffic 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Yara detected XWorm 2->41 8 cmd.exe 2 2->8         started        process3 file4 31 C:\Users\user\Desktop\excelsetup.bat.exe, PE32+ 8->31 dropped 43 Renames powershell.exe to bypass HIPS 8->43 12 excelsetup.bat.exe 19 8->12         started        17 conhost.exe 8->17         started        signatures5 process6 dnsIp7 35 109.107.179.248, 49696, 7000 TELEPORT-TV-ASRU Russian Federation 12->35 33 C:\Users\user\AppData\...\excelsetup.bat, ASCII 12->33 dropped 45 Bypasses PowerShell execution policy 12->45 47 Adds a directory exclusion to Windows Defender 12->47 19 powershell.exe 17 12->19         started        21 powershell.exe 18 12->21         started        23 powershell.exe 16 12->23         started        file8 signatures9 process10 process11 25 conhost.exe 19->25         started        27 conhost.exe 21->27         started        29 conhost.exe 23->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e8f5453c938c96bc1599782b134f57a1e897cc3d2813f8c162e7dafbf791dc9/
Threat name:
Script-BAT.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-02-13 16:00:08 UTC
File Type:
Binary
AV detection:
8 of 26 (30.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r2hviu6jhdewxqkzs6blcnhvpipis7gd2kat7dawfz627p3zdxeq._file
Verdict:
malicious
Similar samples:
452025fa804107ed4d121a58ac4cf7d6c8e5e91c936c5245d0a215b948fc5f6d
XWorm
80c1568ef979e0d9881fa33ee69c3f8c15caa924acd4df9e4c951a7047577caa
XWorm
8df28341644c2139c9d9dfb6231169c70fdb5a18daf628bac6307503f4d0b80f
XWorm
bd45e50b3ec1e76b4cc8c018131921f5237a356b1dcbc9ec69fdf9788edbea58
XWorm
d329a265d4005b2cb8902d6148ff5e4477f2203bc2e476e51e5895f9be99c53e
XWorm
e2cac63bf32a0e4e80b2886b902d3fda4bb3de35dc9bec1c6eb954198c51e374
XWorm
ef69f3e6161a2dbecefb9b991023e062877415ad1c1be084e6d331a91a74e596
XWorm
fa6422c2f12f6bd2e3e59e7e6492e7573124d131a811bd0a5368b6f1365f3916
XWorm
+ 94 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230213-tf7yaaec97/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e8f5453c938c96bc1599782b134f57a1e897cc3d2813f8c162e7dafbf791dc9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/365165/

Comments