MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb
SHA3-384 hash: 555bd780fbfc9945ba70375719c26d2896973456630332ce2ecce259f6cdc08cee61b7eef9e2a6924a09e8556554ee93
SHA1 hash: 6ef8f93a174a2f5895e3775f9aadd956bc4b1e10
MD5 hash: 0505bd66de051dbc2bc1abc304dd6b45
humanhash: hamper-jupiter-carbon-charlie
File name:b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb
Download: download sample
Signature XWorm
Create hunting rule
File size:875'520 bytes
First seen:2026-08-10 13:37:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'191 x AgentTesla, 20'339 x Formbook, 12'364 x SnakeKeylogger)
ssdeep 12288:fga6QlwEasmCS6O3GEftXHCvH2noa8qDJ/VZjwKE2RbndZGpnDnoyyqTlwV6:oa6Uwzsm1FXyHDatPUGRb2hDnFyEuV6
TLSH T1BE1501652369CB06D4BA0FF95971D2745BB46E88B932E20B9FE57ECFB83A7900500353
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/cf9b1406-c464-4d85-819c-7ac1388641ed/
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/79579/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
DNS request
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed remcosrat vbnet
Link:
https://www.filescan.io/uploads/6a79d47a9319687c8f7bf4dd/reports/f52aed57-bd85-4aad-9995-933ec941ebcd/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-02T07:45:00Z UTC
Last seen:
2026-08-11T05:35:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5c354003-1e47-45d7-b2de-99686bd63408
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2026-07-02 13:48:36 UTC
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wsgqd27efbcqeaa4pzehwzttflpzq3jy53x23ilu77qgrn7srdvq._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/97bad07e-2df5-49e4-a06e-a5575590b356
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery persistence privilege_escalation rat trojan
Link:
https://tria.ge/reports/260810-qxj11azcqe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Detect Xworm Payload
Family: Xworm
Unpacked files
SH256 hash:
b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb
MD5 hash:
0505bd66de051dbc2bc1abc304dd6b45
SHA1 hash:
6ef8f93a174a2f5895e3775f9aadd956bc4b1e10
Link:
https://www.unpac.me/results/6d3bc735-411d-43ea-a28c-716919fd0d0f/
SH256 hash:
a070cf3eb06ee34600606f879f42a9d938b1c0d98a9b7772d66cc2997956d4a9
MD5 hash:
ea0b3ae1528f357a9c3d1e011736a9f9
SHA1 hash:
043a223b7adb50237b3bea4e8d7782a794178e06
Link:
https://www.unpac.me/results/6d3bc735-411d-43ea-a28c-716919fd0d0f/
SH256 hash:
013b3d82852b836c2a9cb2fa584510f2fe50ddc017d4117d1aa87ccba1f10ca3
MD5 hash:
98754dfabbd22dd9fd74b4592705fc6c
SHA1 hash:
140bdc0820a0e85c6573fbc3f7bfc43ab460e2d0
Link:
https://www.unpac.me/results/6d3bc735-411d-43ea-a28c-716919fd0d0f/
SH256 hash:
1faed062c4f95ce1e6cf31bd75d1592a122cd5a48e1b16b958c9a19ad32a3972
MD5 hash:
7756a7ef6468a2b1038e0c28826ddb18
SHA1 hash:
77e1089ed44f438113611cb5391b84dfc0b47781
Link:
https://www.unpac.me/results/6d3bc735-411d-43ea-a28c-716919fd0d0f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79579/

Comments