🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375
SHA3-384 hash: 3fd9c719302c3e74737df4def1c7162817b39b2dfe9a5328fb49f8957bd64a69c2aca5664a63ca7df36c63abe2b268f9
SHA1 hash: 5a4b2a74e6c948e603e71df075cdb84e37a9798c
MD5 hash: c4faf5e376bc049a2e22dca8f31e0382
humanhash: fix-ten-cat-alanine
File name:z2PO20240815.pdf.lnk
Download: download sample
Signature XWorm
Create hunting rule
File size:3'568 bytes
First seen:2024-08-19 12:54:09 UTC
Last seen:2026-05-21 14:41:34 UTC
File type:Shortcut (lnk) lnk
MIME type:application/octet-stream
ssdeep 48:83DHD9/E9blAYSwEPGcaxY/UwEPGcarNlbdX:83Dj9/19wBrw735
TLSH T1E7710E2067F80624E3F36FBA6D7B99A05C77B82A9D34C61C10AC514D0723E18CD31B2B
Reporter FXOLabs
Tags:lnk xworm

Intelligence

File Origin
# of uploads :
3
# of downloads :
123
Origin country :
BR BR
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28759.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADayrundll.20231121.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66c340a8b2a4681a7296511c
Tags:
Execution Generic Infostealer Network Stealth Pantera
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375/results/dashboard
Payload URLs
URL
File name
C:\Users\Public\Documents\Statement_of_Account.pdf';$Yu9N3K
LNK File
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
macros masquerade packed polyglot
Link:
https://www.filescan.io/uploads/66c340af9a458267e53eddfc/reports/a6c74e2c-1ff9-4471-a534-1c613b23fcbc/overview
Verdict:
Malicious
Labled as:
BZC.YAX.Pantera.60
Link:
https://www.hybrid-analysis.com/sample/c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1494946
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Execute DLL with spoofed extension
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Powershell Download and Execute IEX
Sigma detected: Powershell downloading file from url shortener site
Sigma detected: System File Execution Location Anomaly
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to download and execute files (via powershell)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses dynamic DNS services
Windows shortcut file (LNK) contains suspicious command line arguments
Windows shortcut file (LNK) starts blacklisted processes
Writes to foreign memory regions
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1494946 Sample: z2PO20240815.pdf.lnk Startdate: 19/08/2024 Architecture: WINDOWS Score: 100 84 xwram1.duckdns.org 2->84 86 ima.dzgsm.com 2->86 88 2 other IPs or domains 2->88 102 Suricata IDS alerts for network traffic 2->102 104 Found malware configuration 2->104 106 Malicious sample detected (through community Yara rule) 2->106 110 24 other signatures 2->110 9 powershell.exe 17 21 2->9         started        14 rundll32.exe 2->14         started        16 rundll32.exe 2->16         started        18 svchost.exe 1 1 2->18         started        signatures3 108 Uses dynamic DNS services 84->108 process4 dnsIp5 92 ima.dzgsm.com 54.36.173.156, 443, 49706, 49708 OVHFR France 9->92 94 cutt.ly 172.67.8.238, 443, 49705, 49707 CLOUDFLARENETUS United States 9->94 76 C:\Users\Public\Downloads\license.txt, MS-DOS 9->76 dropped 78 C:\Users\Public\...\Statement_of_Account.pdf, PDF 9->78 dropped 122 Suspicious execution chain found 9->122 124 Powershell drops PE file 9->124 20 rundll32.exe 1 8 9->20         started        24 Acrobat.exe 17 76 9->24         started        26 conhost.exe 1 9->26         started        80 C:\Users\user\AppData\Local\Temp\wcE23C.tmp, PE32 14->80 dropped 126 Windows shortcut file (LNK) starts blacklisted processes 14->126 128 System process connects to network (likely due to code injection or exploit) 14->128 130 Writes to foreign memory regions 14->130 28 cmd.exe 14->28         started        36 4 other processes 14->36 82 C:\Users\user\AppData\Local\Temp\wcC2FC.tmp, PE32 16->82 dropped 30 cmd.exe 16->30         started        32 cmd.exe 16->32         started        34 cmd.exe 16->34         started        38 2 other processes 16->38 96 127.0.0.1 unknown unknown 18->96 file6 signatures7 process8 file9 72 C:\Users\user\AppData\Local\Temp\wc7828.tmp, PE32 20->72 dropped 112 Windows shortcut file (LNK) starts blacklisted processes 20->112 114 Creates an autostart registry key pointing to binary in C:\Windows 20->114 116 Writes to foreign memory regions 20->116 118 Found hidden mapped module (file has been removed from disk) 20->118 40 RegSvcs.exe 20->40         started        56 4 other processes 20->56 44 AcroCEF.exe 109 24->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        50 conhost.exe 32->50         started        52 conhost.exe 34->52         started        59 3 other processes 36->59 54 conhost.exe 38->54         started        signatures10 process11 dnsIp12 90 xwram1.duckdns.org 193.187.91.208, 49729, 58345 OBE-EUROPEObenetworkEuropeSE Sweden 40->90 120 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->120 61 AcroCEF.exe 6 44->61         started        74 C:\Users\user\AppData\Roaming\...\license.txt, MS-DOS 56->74 dropped 64 conhost.exe 56->64         started        66 conhost.exe 56->66         started        68 conhost.exe 56->68         started        70 conhost.exe 56->70         started        file13 signatures14 process15 dnsIp16 98 52.5.13.197, 443, 49718, 49721 AMAZON-AESUS United States 61->98 100 23.56.162.185, 443, 49723 AKAMAI-ASUS United States 61->100
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375/
Threat name:
Shortcut.Trojan.Pantera
Create hunting rule
Status:
Malicious
First seen:
2024-08-16 01:53:40 UTC
File Type:
Binary
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ygwgmqf3orby66tmimfljryb67npeel3q5jc7g5uxdng7xfbwn2q._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence rat trojan
Link:
https://tria.ge/reports/240819-p5r6xavepa/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Detect Xworm Payload
Xworm
Malware Config
C2 Extraction:
xwram1.duckdns.org:58345
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.57
Link:
https://yomi.yoroi.company/submissions/c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:PDF_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies Adobe Acrobat artefacts in shortcut (LNK) files.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:SMB_in_LNK
Create hunting rule
Author:@bartblaze
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Shortcut (lnk) lnk c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments