MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 22


Intelligence 22 IOCs 1 YARA 17 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30
SHA3-384 hash: a66aefa0ba056d8775b0d757044b2dfc9b14f5f8e86b8b5b5a9245e337af111ed551826322f75557efc49cbdd711d4a8
SHA1 hash: 872a708c000d1aee5a20a2c59247bec980e62528
MD5 hash: 0756de1b9c8f99dcb477d7b49feae2a0
humanhash: happy-mobile-lactose-hawaii
File name:0srAxLR.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:34'816 bytes
First seen:2025-09-06 21:20:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 384:Q0CI3+xD4baa2yf9SnR2VLL5HsUwQ3wfk/PVRipkFTBLT4ZwYGDcvw9IkuisbuFP:PCi+xDG2sVXxsU7gEVfFp9jFOjhJ/W5
TLSH T14AF23B09F7904355D9EEAFF169B361090231E607D923EB5E0CE884DA2F27AC0CD527E6
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe xworm


Avatar
abuse_ch
XWorm C2:
132.145.75.68:1878

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
132.145.75.68:1878 https://threatfox.abuse.ch/ioc/1582855/

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
a881925ab6bb6488d6c09ce176612eded9913dbc61c0f88fb1565a555f359012.exe
Verdict:
Malicious activity
Analysis date:
2025-09-06 21:00:11 UTC
Tags:
lumma stealer themida amadey botnet loader auto redline auto-reg rdp autoit auto-sch stealc auto-startup inno installer delphi purelogs anti-evasion vidar telegram
Link:
https://app.any.run/tasks/84ecf293-2202-47e5-a5cd-407333504c7b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/26032/
Detection(s):
Win.Packed.njRAT-10002074-1
Create hunting rule

Win.Packed.Msilzilla-10019837-0
Create hunting rule

Win.Packed.Loveletter-10023052-0
Create hunting rule

Win.Packed.Loveletter-10024677-0
Create hunting rule

Win.Packed.Msilzilla-10026193-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.AsyncRAT.UNOFFICIAL
Create hunting rule

ditekSHen.MALWARE.Win.XWorm.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bca5b3eb163e0ec1852a67
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 fingerprint njrat njrat rat reconnaissance vbnet xworm
Link:
https://www.filescan.io/uploads/68bca5bf37c25fcf12d5d79a/reports/2cdccef3-e64f-47a3-a95e-787e921c0668/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-06T16:07:00Z UTC
Last seen:
2025-09-06T16:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30/results?tab=lookup
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/584d935f-c08a-43ce-83f5-90811e28bdd6
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1772474
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates / moves files in alternative data streams (ADS)
Detected unpacking (creates a PE file in dynamic memory)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Encrypted powershell cmdline option found
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1772474 Sample: 0srAxLR.exe Startdate: 06/09/2025 Architecture: WINDOWS Score: 100 116 cx3fbungd.localto.net 2->116 118 github.com 2->118 124 Suricata IDS alerts for network traffic 2->124 126 Found malware configuration 2->126 128 Malicious sample detected (through community Yara rule) 2->128 130 16 other signatures 2->130 10 0srAxLR.exe 3 8 2->10         started        15 CopilotService.exe 2->15         started        17 CopilotService.exe 2->17         started        19 Explorer.exe 2->19         started        signatures3 process4 dnsIp5 122 cx3fbungd.localto.net 132.145.75.68, 1878, 49719 ORACLE-BMC-31898US United States 10->122 108 C:\XWormClient.exe, PE32 10->108 dropped 110 C:\Users\user\AppData\Local\Temp\ygsxvq.exe, PE32 10->110 dropped 112 C:\Users\user\AppData\Local\Temp\lmejbl.exe, PE32+ 10->112 dropped 114 C:\Users\user\AppData\Local\Temp\ahtgav.exe, PE32+ 10->114 dropped 164 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->164 166 Tries to harvest and steal browser information (history, passwords, etc) 10->166 21 ahtgav.exe 10->21         started        25 lmejbl.exe 1 9 10->25         started        27 ygsxvq.exe 10->27         started        168 Antivirus detection for dropped file 15->168 170 Multi AV Scanner detection for dropped file 15->170 172 Detected unpacking (creates a PE file in dynamic memory) 15->172 174 Encrypted powershell cmdline option found 15->174 29 CopilotService.exe 15->29         started        31 net.exe 15->31         started        33 CopilotService.exe 17->33         started        35 net.exe 17->35         started        file6 signatures7 process8 file9 92 C:\Users\...\backend_c.cp311-win_amd64.pyd, PE32+ 21->92 dropped 94 C:\Users\user\...\_cffi.cp311-win_amd64.pyd, PE32+ 21->94 dropped 96 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 21->96 dropped 106 61 other malicious files 21->106 dropped 132 Multi AV Scanner detection for dropped file 21->132 37 ahtgav.exe 21->37         started        98 C:\Users\user\AppData\...\CopilotService.exe, PE32+ 25->98 dropped 100 C:\Users\user\AppData\...\WeatherHost.exe, PE32+ 25->100 dropped 102 C:\Users\user\AppData\...\WeatherHost.exe:62, very 25->102 dropped 134 Creates / moves files in alternative data streams (ADS) 25->134 136 Encrypted powershell cmdline option found 25->136 40 powershell.exe 18 25->40         started        47 4 other processes 25->47 104 C:\Windows\System32\SubDirxplorer.exe, PE32 27->104 dropped 138 Drops executables to the windows directory (C:\Windows) and starts them 27->138 140 Uses schtasks.exe or at.exe to add and modify task schedules 27->140 142 Drops PE files with benign system names 27->142 144 Hides that the sample has been downloaded from the Internet (zone.identifier) 27->144 43 Explorer.exe 27->43         started        45 schtasks.exe 27->45         started        49 5 other processes 29->49 51 2 other processes 31->51 146 Found direct / indirect Syscall (likely to bypass EDR) 33->146 53 5 other processes 33->53 55 2 other processes 35->55 signatures10 process11 dnsIp12 120 github.com 140.82.114.3 GITHUBUS United States 37->120 57 attrib.exe 37->57         started        148 Encrypted powershell cmdline option found 40->148 150 Adds a directory exclusion to Windows Defender 40->150 152 Found suspicious powershell code related to unpacking or dynamic code loading 40->152 59 powershell.exe 22 40->59         started        62 conhost.exe 40->62         started        154 System process connects to network (likely due to code injection or exploit) 43->154 156 Hides that the sample has been downloaded from the Internet (zone.identifier) 43->156 158 Installs a global keyboard hook 43->158 64 schtasks.exe 43->64         started        66 conhost.exe 45->66         started        68 powershell.exe 47->68         started        70 5 other processes 47->70 72 8 other processes 49->72 160 Loading BitLocker PowerShell Module 53->160 74 8 other processes 53->74 signatures13 process14 signatures15 76 conhost.exe 57->76         started        162 Loading BitLocker PowerShell Module 59->162 78 conhost.exe 59->78         started        80 conhost.exe 64->80         started        82 conhost.exe 68->82         started        84 conhost.exe 72->84         started        86 conhost.exe 72->86         started        88 conhost.exe 74->88         started        90 conhost.exe 74->90         started        process16
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30
Verdict:
njRat
YARA:
17 match(es)
Tags:
.Net Executable Managed .NET njRat PE (Portable Executable) PE File Layout RAT SOS: 0.22 Win 32 Exe x86 XWorm
Malware Config
C2 Extraction:
CNC: cx3fbungd.localto.net
PORT: 1878
Link:
https://app.malva.re/file/0756de1b9c8f99dcb477d7b49feae2a0
Detection:
xworm
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30/
Threat name:
ByteCode-MSIL.Spyware.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2025-09-06 21:21:37 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
32 of 38 (84.21%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wza5i7gxdcaetrvezqszsgozlwccax2njzvtfvkybmoemkuhz4ya._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
error
XWorm
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm rat trojan
Link:
https://tria.ge/reports/250906-z66e2afp9s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Drops startup file
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
cx3fbungd.localto.net:1878
Verdict:
Malicious
Tags:
rat xworm Win.Packed.njRAT-10002074-1
YARA:
MALWARE_Win_XWorm win_mal_XWorm
Link:
https://app.threat.zone/submission/64e7fef8-9450-486e-a14a-26d8c5509a9d
Unpacked files
SH256 hash:
b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30
MD5 hash:
0756de1b9c8f99dcb477d7b49feae2a0
SHA1 hash:
872a708c000d1aee5a20a2c59247bec980e62528
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
Link:
https://www.unpac.me/results/b53f0943-fe60-46f3-9f93-233dfc28e09a/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b641d47cd718/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XWorm

Executable exe b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/26032/
  
URLhaus
https://urlhaus.abuse.ch/url/3617804/
  
Delivery method
Distributed via web download

Comments


Avatar
commented on 2025-09-06 21:25:59 UTC

RAT King Parser (https://github.com/jeFF0Falltrades/rat_king_parser) Output:

{
"sha256": "b641d47cd7188049c6a4cc259919d95d84205f4d4e6b32d5580b1c462a87cf30",
"yara_possible_family": "xworm",
"key": "9f1099e5aa94117283100d105c44759f1099e5aa94117283100d105c44756700",
"salt": "None",
"config": {
"Hosts": [
"cx3fbungd.localto.net"
],
"Ports": [
"1878"
],
"KEY": "Lucky",
"SPL": "<XWormmm>",
"Sleep": "1",
"Group": "X",
"USBNM": "USB.exe",
"InstallDir": "",
"InstallStr": "XWormClient.exe",
"Mutex": "ITX7C9q7DCe3o1J5"
}
}