MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkVisionRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2
SHA3-384 hash: c0268c582ed1842f86bbd347acb8f0910febbece7a92a1a403e6a7de35a8e84fcb1d0f4904e00f163ab36ba034535a99
SHA1 hash: 0d6ea17ba59d821d9ebec9b4c21161bc39855688
MD5 hash: a5544c1b05350b9e31c4f661813eaaf0
humanhash: beer-harry-india-finch
File name:New purchase Order.bat
Download: download sample
Signature DarkVisionRAT
Create hunting rule
File size:1'984'130 bytes
First seen:2025-12-19 07:33:11 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 6144:fibuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuN:fih
Threatray 1'964 similar samples on MalwareBazaar
TLSH T17D954C1295FA813639D6287C05DF9633B55AF7980EA46BB0B40119EF07DEB073DDAB20
Magika batch
Reporter lowmal3
Tags:bat DarkVisionRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
New purchase Order.bat
Verdict:
Malicious activity
Analysis date:
2025-12-19 07:35:19 UTC
Tags:
loader reverseloader auto-reg susp-powershell remote xworm payload
Link:
https://app.any.run/tasks/b6973077-5a6e-4515-accd-4b41425fe678

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45486/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6944ffbf021cfe859b07bab1
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching cmd.exe command interpreter
Forced system process termination
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Sending an HTTP GET request
Creating a process with a hidden window
Enabling autorun by creating a file
Unauthorized injection to a system process
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd lolbin masquerade
Link:
https://www.filescan.io/uploads/6944ffbca7163552ba02bc45/reports/c0d43de1-8338-4421-9d79-017c22aa8e04/overview
Verdict:
Suspicious
Labled as:
TrojanDownloader/BAT.Netloader
Link:
https://www.hybrid-analysis.com/sample/bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-12-18T21:39:00Z UTC
Last seen:
2025-12-21T05:22:00Z UTC
Hits:
~1000
Detections:
Trojan.Agentb.TCP.C&C Backdoor.MSIL.XWorm.a Trojan.MSIL.DOTHETUK.sb Trojan.MSIL.Crypt.sb Trojan.Agent.TCP.ServerRequest PDM:Trojan.Win32.GenAutorunSchedulerTaskRun.c Trojan-Downloader.MSIL.Seraph.d Trojan.MSIL.Miner.sb Trojan.BAT.Agent.sb PDM:Trojan.Win32.Generic HEUR:Trojan.Multi.Powedon.a HEUR:Trojan.BAT.Agent.gen Trojan-Downloader.MSIL.Agent.c Trojan.Inject.TCP.ServerRequest Backdoor.MSIL.XWorm.b Backdoor.Agent.TCP.C&C
Link:
https://opentip.kaspersky.com/bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2/results?tab=lookup
Result
Threat name:
DarkCloud, DarkVision Rat, XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1836126
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates multiple autostart registry keys
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain checking for user administrative privileges
Found large BAT file
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected DarkCloud
Yara detected DarkVision Rat
Yara detected Powershell decode and execute
Yara detected Telegram RAT
Yara detected UAC Bypass using CMSTP
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1836126 Sample: New purchase Order.bat Startdate: 19/12/2025 Architecture: WINDOWS Score: 100 111 somethingood.viewdns.net 2->111 113 shed.dual-low.part-0013.t-0009.t-msedge.net 2->113 115 5 other IPs or domains 2->115 127 Suricata IDS alerts for network traffic 2->127 129 Found malware configuration 2->129 131 Malicious sample detected (through community Yara rule) 2->131 133 23 other signatures 2->133 12 cmd.exe 1 2->12         started        15 refronted.exe 2->15         started        17 refronted.exe 2->17         started        19 8 other processes 2->19 signatures3 process4 signatures5 175 Suspicious powershell command line found 12->175 177 Bypasses PowerShell execution policy 12->177 179 Adds a directory exclusion to Windows Defender 12->179 21 powershell.exe 14 16 12->21         started        26 cmd.exe 1 12->26         started        28 conhost.exe 12->28         started        181 Antivirus detection for dropped file 15->181 183 Multi AV Scanner detection for dropped file 15->183 185 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->185 187 Tries to steal Mail credentials (via file / registry access) 17->187 189 Tries to harvest and steal browser information (history, passwords, etc) 17->189 30 conhost.exe 19->30         started        32 cmd.exe 19->32         started        34 conhost.exe 19->34         started        36 6 other processes 19->36 process6 dnsIp7 117 somethingood.viewdns.net 148.251.11.209, 3242, 49718, 49726 HETZNER-ASDE Germany 21->117 119 ia801709.us.archive.org 207.241.233.39, 443, 49717 INTERNET-ARCHIVEUS United States 21->119 97 C:\Users\Public\Downloads\zHrSW1PIjq, JPEG 21->97 dropped 141 Writes to foreign memory regions 21->141 143 Injects a PE file into a foreign processes 21->143 38 MSBuild.exe 3 9 21->38         started        42 MSBuild.exe 21->42         started        44 conhost.exe 21->44         started        46 cmd.exe 26->46         started        48 powershell.exe 30->48         started        50 conhost.exe 30->50         started        52 microsofts.exe 32->52         started        file8 signatures9 process10 file11 99 C:\Users\user\AppData\...\XWormClient.exe, PE32 38->99 dropped 101 C:\Users\user\AppData\Local\Temp\kdpehp.exe, PE32 38->101 dropped 103 C:\Users\user\AppData\Local\Temp\ghmkud.EXE, PE32+ 38->103 dropped 105 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 38->105 dropped 145 Creates multiple autostart registry keys 38->145 147 Adds a directory exclusion to Windows Defender 38->147 54 ghmkud.EXE 38->54         started        58 kdpehp.exe 38->58         started        60 cmd.exe 38->60         started        62 6 other processes 38->62 149 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 42->149 151 Uses schtasks.exe or at.exe to add and modify task schedules 42->151 153 Loading BitLocker PowerShell Module 48->153 signatures12 process13 file14 107 C:\ProgramData\microsofts\microsofts.exe, PE32+ 54->107 dropped 155 Multi AV Scanner detection for dropped file 54->155 157 Found evasive API chain (may stop execution after checking mutex) 54->157 159 Adds a directory exclusion to Windows Defender 54->159 173 2 other signatures 54->173 64 microsofts.exe 54->64         started        67 cmd.exe 54->67         started        109 C:\Users\user\AppData\...\refronted.exe, PE32 58->109 dropped 161 Antivirus detection for dropped file 58->161 163 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 58->163 165 Tries to steal Mail credentials (via file / registry access) 58->165 167 Creates multiple autostart registry keys 58->167 169 Suspicious powershell command line found 60->169 69 cmd.exe 60->69         started        71 powershell.exe 60->71         started        73 conhost.exe 60->73         started        171 Loading BitLocker PowerShell Module 62->171 75 conhost.exe 62->75         started        77 conhost.exe 62->77         started        79 conhost.exe 62->79         started        81 3 other processes 62->81 signatures15 process16 signatures17 121 Multi AV Scanner detection for dropped file 64->121 123 Adds a directory exclusion to Windows Defender 64->123 125 Maps a DLL or memory area into another process 64->125 83 cmd.exe 64->83         started        86 explorer.exe 64->86         started        88 cmd.exe 69->88         started        90 conhost.exe 71->90         started        process18 signatures19 135 Adds a directory exclusion to Windows Defender 83->135 92 powershell.exe 83->92         started        95 conhost.exe 83->95         started        137 System process connects to network (likely due to code injection or exploit) 86->137 139 Unusual module load detection (module proxying) 86->139 process20 signatures21 191 Loading BitLocker PowerShell Module 92->191
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2
Threat name:
Win32.Trojan.Yomal
Create hunting rule
Status:
Malicious
First seen:
2025-12-19 05:28:06 UTC
File Type:
Text (Batch)
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xx3uphwz2fnnfag333cz57frzhqsfug3est4xyzourkc4s6q7tja._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
031c6bc2328cb229b20ee852b4506f036811e3f1bdff846668aec1aa43833edc
DarkVisionRAT
3312046853616821d8aad2a3bb0b42bfb10171cf866d58b026fea0a673da4992
DarkVisionRAT
3f7b2cb716cf7f7f4a7eccff6dd9dd0a0a67145848c931cabf7db0b06bdd53e7
DarkVisionRAT
581a433981d464845834eb17631355b5efefe97ebd132ff2dcd3ad925e98c80a
DarkVisionRAT
7f2356edf41535b99a2ac77ce9f9eaf497e0907bfe53dc0165d4ab08384cec57
DarkVisionRAT
c1a9b4928efb23673306553543b9f6efbfdb3dfa801c734a31a90a550cb2e3dc
DarkVisionRAT
dab8b3d169646219ed9b717dde20b09db8bef18a22f07414a365b346dff13486
DarkVisionRAT
ed556be04b495855c63dea609dfdece80c7812f9606882d1f031c99b1420b5c1
DarkVisionRAT
error
DarkVisionRAT
+ 1'954 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/251223-p77dlszlas/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
https://ia801709.us.archive.org/8/items/optimized_msi_20251216_1724/optimized_MSI.png
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bdf7479ed9d1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkVisionRAT

Batch (bat) bat bdf7479ed9d15ad280dbdec59efcb1c9e122d0db24a7cbe32ea4542e4bd0fcd2

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/45486/

Comments