MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b63dc73acf2e5286097608fb63edea904789e1695e29090da8979e187f7fa4b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b63dc73acf2e5286097608fb63edea904789e1695e29090da8979e187f7fa4b9
SHA3-384 hash: aae9a1a3d679e76f8ebd177bdb120226f9f4ef91165be55ce1c520490a10ba8e2295f991ca79127f11687630629622a3
SHA1 hash: 92f627b197d39c4e34b9ec2c08dc10526a32b603
MD5 hash: a90c3f7ef1f94c118ba74c7acfc2612e
humanhash: fifteen-leopard-double-one
File name:SPE-2025010-WA001310_pdf.rar
Download: download sample
Signature XWorm
Create hunting rule
File size:46'665 bytes
First seen:2025-10-29 09:54:00 UTC
Last seen:2025-10-29 12:22:37 UTC
File type: rar
MIME type:application/x-rar
ssdeep 768:4WWHCI7RdiN/Gvz4N5kOAL+fFYZtz2E5tN15CGT/Jn5zxbovm+gT6KlPuOoFC8NX:4WY/b4N5kVLiUR3JLJ5NbSarG3NX
TLSH T1F5230241C3605CB0C9322D5521DABFB938B68B2D69568DFD43A43FA4A63D037E01AF86
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter cocaman
Tags:rar xworm


Avatar
cocaman
Malicious email (T1566.001)
From: "Marnorman Mamat <Mmarmat@sapuraenergy.com>" (likely spoofed)
Received: "from [178.16.55.129] (unknown [178.16.55.129]) "
Date: "28 Oct 2025 17:59:27 -0700"
Subject: "REQUEST FOR QUOTE_REF-SPE-2025010-WA001310"
Attachment: "SPE-2025010-WA001310_pdf.rar"

Intelligence

File Origin
# of uploads :
110
# of downloads :
79
Origin country :
CH CH
Vendor Threat Intelligence
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6901e462706befaf4ec9ed6a
Tags:
shell spawn
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6901e45ff1fa8cbc03116a3d/reports/320cc002-19fb-42e6-a221-424ae98b27c4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b63dc73acf2e5286097608fb63edea904789e1695e29090da8979e187f7fa4b9
Verdict:
Malicious
File Type:
rar
First seen:
2025-10-29T08:01:00Z UTC
Last seen:
2025-10-29T08:24:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b63dc73acf2e5286097608fb63edea904789e1695e29090da8979e187f7fa4b9/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Rar Archive
Link:
https://app.malva.re/file/a90c3f7ef1f94c118ba74c7acfc2612e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b63dc73acf2e5286097608fb63edea904789e1695e29090da8979e187f7fa4b9/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-10-29 03:05:26 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
7 of 37 (18.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wy64oowpfzjimclwbd5wh3pksbdytyljlyuqsdnis6pbq737us4q._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm execution persistence rat trojan
Link:
https://tria.ge/reports/251029-m98ncafr6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Drops startup file
Executes dropped EXE
Badlisted process makes network request
Contains code to disable Windows Defender
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
178.16.55.129:6333
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b63dc73acf2e5286097608fb63edea904789e1695e29090da8979e187f7fa4b9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

rar b63dc73acf2e5286097608fb63edea904789e1695e29090da8979e187f7fa4b9

(this sample)

XWorm

Batch (bat) bat 84bc64c5f0b3e217896ebecb8b6d434d0c8fb4c33aa87125b3b8e2062aa283d5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84bc64c5f0b3e217896ebecb8b6d434d0c8fb4c33aa87125b3b8e2062aa283d5
  
Dropping
MD5 8cde5a08d28c27492154526f4dc3bc41
  
Dropping
XWorm

Comments