MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96abd6a3639256ee1af74f2a6d7cacde5a0820e5003f37995df5459d6c11cd7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

AU

File Archive Information

This file is a password protected archive. The password is: infected

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	5a727248fe722916946596cd5dbad79c52753b9eb964e90593ff5f75940a481a
File size:	2'004'875 bytes
SHA256 hash:	5a727248fe722916946596cd5dbad79c52753b9eb964e90593ff5f75940a481a
MD5 hash:	b94099c18a56c2984918dbdac0ce94ec
MIME type:	application/zip
Signature	XWorm

Vendor Threat Intelligence

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/96abd6a3639256ee1af74f2a6d7cacde5a0820e5003f37995df5459d6c11cd7c/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/96abd6a3639256ee1af74f2a6d7cacde5a0820e5003f37995df5459d6c11cd7c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/96abd6a3639256ee1af74f2a6d7cacde5a0820e5003f37995df5459d6c11cd7c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96abd6a3639256ee1af74f2a6d7cacde5a0820e5003f37995df5459d6c11cd7c/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s2v5ni3dsjlo4gxxj4vg27fm3znaqihfaa7tpgk56vcz23arzv6a._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm rat trojan

Link:

https://tria.ge/reports/230824-kq1ghsbc76/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes dropped EXE

Loads dropped DLL

Xworm

Malware Config

C2 Extraction:

45.61.130.7:1010

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/96abd6a3639256ee1af74f2a6d7cacde5a0820e5003f37995df5459d6c11cd7c