MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c59ca57605f1547bb03591cbd516c45857654c35dfcfe5a4105ffa1fa0d48b71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 15
| SHA256 hash: | c59ca57605f1547bb03591cbd516c45857654c35dfcfe5a4105ffa1fa0d48b71 |
|---|---|
| SHA3-384 hash: | 94bbb0cddd66c3e2a52a9d62063b125127776a765a087a016ed5c8ea765c02b5d17c417f5c98f14ddae0072b0daf951e |
| SHA1 hash: | 55a47f3518e656f424d2f0ff2ae9918533c90c16 |
| MD5 hash: | 790face14452f40c78304ec337c405ac |
| humanhash: | fruit-magnesium-bravo-ceiling |
| File name: | importantdocument.exe |
| Download: | download sample |
| Signature | XWorm |
| File size: | 235'688 bytes |
| First seen: | 2026-02-03 03:09:27 UTC |
| Last seen: | 2026-02-03 03:34:30 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | a60e2f996367d3f0f40289c655d2d075 (6 x XWorm, 1 x AsyncRAT, 1 x StormKitty) |
| ssdeep | 6144:VONUtemwXjg7WawYfQGqGgvyXe31bXbeO:5K05ESO3VX |
| TLSH | T124346A28F19EE13FD13089B52D141FDC11F985B9F0C6AA0AD2516B3A27B09B27F7D606 |
| TrID | 77.2% (.EXE) Win32 Executable Microsoft Visual Basic 6 (82067/2/8) 6.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  qemped |
| Tags: | exe xworm |
Intelligence
File Origin
# of uploads :
2
# of downloads :
123
Origin country :
IDVendor Threat Intelligence
Malware configuration found for:
GuLoader
Details
Malware family:
n/a
ID:
1
File name:
importantdocument.exe
Verdict:
Malicious activity
Analysis date:
2026-02-03 03:07:43 UTC
Tags:
evasion telegram remote xworm ims-api generic crypto-regex
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Verdict:
Malicious
Score:
94.9%
Tags:
injection obfusc remo
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file
Launching a process
Setting a keyboard event handler
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
ngrbot overlay powershell remcos unsafe visual_basic zusy
Verdict:
Malicious
Labled as:
Trojan.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-02T23:10:00Z UTC
Last seen:
2026-02-03T07:49:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.MSIL.StormKitty.aeh PDM:Trojan.Win32.Generic Backdoor.Agent.TCP.C&C Trojan.Win32.Agent.sb HEUR:Trojan.Win32.Generic HEUR:Trojan.MSIL.PowerShell.gen VHO:Backdoor.Win32.Convagent.gen Trojan.WinLNK.Agent.fb Trojan.Win32.Vimditator.sb
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Visual Basic Visual Basic 6 Win 32 Exe x86
Verdict:
Malicious
Threat:
Trojan-PSW.MSIL.StormKitty
Threat name:
Win32.Trojan.Injuke
Status:
Malicious
First seen:
2026-02-03 00:33:45 UTC
AV detection:
27 of 38 (71.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Looks up external IP address via web service
Executes dropped EXE
Unpacked files
SH256 hash:
c59ca57605f1547bb03591cbd516c45857654c35dfcfe5a4105ffa1fa0d48b71
MD5 hash:
790face14452f40c78304ec337c405ac
SHA1 hash:
55a47f3518e656f424d2f0ff2ae9918533c90c16
SH256 hash:
cd1234b5210d1794e60f8a52738aa2c3625eeac5fe91f669821f628bdf1d9d22
MD5 hash:
dcecd0f03ce561121518b480baa13528
SHA1 hash:
21016722779a1bf017b1871573f4b22a986eefa9
SH256 hash:
70192cd3dafec42a02437bf1f83660e7419d8d2c4feb6da2b13611da1a9e5372
MD5 hash:
d8f3c0274b7b256feda1f25132522770
SHA1 hash:
9012fea349e0ac15d0f8d65c7e6a3eb60c84d389
SH256 hash:
2969b154c68710f99b9da5c4260352ffb8e532678c45e351a6e1325c7e4b1da0
MD5 hash:
edde6fe8334ec590c16a492ff8fb74c8
SHA1 hash:
08f3702db2eb7f0ef05255a3c32186725e546481
Malware family:
XWorm
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | SEH__vba |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.