MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078
SHA3-384 hash: a98ba23eee7423dbced3a51c5ed3ddfd5356e9d7c34dfb3139e1a146b515f8b25885f9e813fbc7d1922bd86d3817980e
SHA1 hash: f91a290a1ff7845e6d0784573c49394a14f29dc5
MD5 hash: 5638b164db53c58bacfd971566eba85c
humanhash: lithium-music-east-black
File name:Offerteaanvraag_9100037009120250_HTM_Aerotec.bat
Download: download sample
Signature XWorm
Create hunting rule
File size:7'838 bytes
First seen:2025-09-25 13:33:08 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 192:thGOdOMaZC3pu7u+bvdhsq4GsI6ck/NU7k3h+kmpLac1NVOtMTKxmuxmusgRuUsJ:7GOdOMaZC3pu7u+bvdhsq4GsI6ck/NUf
Threatray 2'425 similar samples on MalwareBazaar
TLSH T1B3F1CC7C98BDA9315A73C79578038E92AD68C55C3E1EC535B2C807122831AE9F47EF0B
Magika vba
Reporter abuse_ch
Tags:bat xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Offerteaanvraag_9100037009120250_HTM_Aerotec.bat
Verdict:
Malicious activity
Analysis date:
2025-09-25 13:38:27 UTC
Tags:
payload loader reverseloader susp-powershell remote xworm
Link:
https://app.any.run/tasks/914a59e5-9d89-44df-bc9d-37b15f779b72

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29026/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d552d91e4783989051f4f1
Tags:
obfuscate xtreme shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 evasive obfuscated obfuscated opendir opendir overlay powershell
Link:
https://www.filescan.io/uploads/68d544d8674d5fd6aa0c72f8/reports/0b4d4bc2-a267-494f-85b0-a7a8478269ef/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078
Verdict:
Clean
File Type:
text
First seen:
2025-09-25T02:56:00Z UTC
Last seen:
2025-09-25T02:56:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1784122
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1784122 Sample: Offerteaanvraag_91000370091... Startdate: 25/09/2025 Architecture: WINDOWS Score: 100 26 fireblazecorrect.duckdns.org 2->26 28 laoufi.com 2->28 30 ia601001.us.archive.org 2->30 40 Suricata IDS alerts for network traffic 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 48 10 other signatures 2->48 8 cmd.exe 1 2->8         started        11 svchost.exe 1 1 2->11         started        signatures3 46 Uses dynamic DNS services 26->46 process4 dnsIp5 52 Suspicious powershell command line found 8->52 54 Bypasses PowerShell execution policy 8->54 14 powershell.exe 14 15 8->14         started        18 conhost.exe 8->18         started        34 127.0.0.1 unknown unknown 11->34 signatures6 process7 dnsIp8 36 laoufi.com 141.94.100.184, 443, 49682 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 14->36 38 ia601001.us.archive.org 207.241.227.31, 49681, 80 INTERNET-ARCHIVEUS United States 14->38 56 Writes to foreign memory regions 14->56 58 Injects a PE file into a foreign processes 14->58 20 CasPol.exe 4 14->20         started        24 conhost.exe 14->24         started        signatures9 process10 dnsIp11 32 fireblazecorrect.duckdns.org 172.245.112.200, 49687, 9870 AS-COLOCROSSINGUS United States 20->32 50 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->50 signatures12
Score:
7%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-09-25 13:36:00 UTC
File Type:
Text (Batch)
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zgb27axfpajjhspst5z6zqvpyao74zdmxgqx7naw7lzsz7gbmb4a._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
0cdbc8796b5a5adba8b361c2b13626b03c4b25975244bec36b6acf0dcde65352
XWorm
3b39da6b761aebfac6324138212fd5a6eeb89a50ef1e7b8f8a813c07ac920062
XWorm
41cdbafba89bad77d1784458e5c226eb405ca9f46bb65a38031c48a97e6eef84
XWorm
45ba32fcb65201e7cae3d05f77178e08fd41380624edd777e355c63ac1d126b7
XWorm
699b91f69cd0d059794175c55675ad931a2eaa18cb713523265429da6b021633
XWorm
error
XWorm
f03cc966d2abcece5e21a8c90cb2ae5472971202377c59187821f3188012d992
XWorm
+ 2'415 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution rat trojan
Link:
https://tria.ge/reports/250925-qvfkssylz8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
fireblazecorrect.duckdns.org:9870
maintainthefeex.duckdns.org:9870
masqingtestformat.gleeze.com:9870
Dropper Extraction:
http://ia601001.us.archive.org/25/items/msi-pro-with-b-64_20250923/MSI_PRO_with_b64.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Batch (bat) bat c983af82e5781293c9f29f73ecc2afc01dfe646cb9a17fb416faf32cfcc16078

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/29026/

Comments