MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51
SHA3-384 hash: 225f20ef1fb8aa80d1e512ba8c563f899dc356f9892d6ef6a537bc7f0c0203462e1b40e7c5c83124d421bd84c8bf71fa
SHA1 hash: 147e3589230991ddb46c512396da22f259099b8b
MD5 hash: 0ff05fe7afc2ffab2e2e3527e2a34918
humanhash: romeo-victor-twelve-stairway
File name:0ff05fe7afc2ffab2e2e3527e2a34918.exe
Download: download sample
Signature XWorm
Create hunting rule
File size:404'480 bytes
First seen:2025-12-07 18:05:19 UTC
Last seen:2025-12-08 10:25:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a50e815adb2cfe3e58d388c791946db8 (2 x njrat, 2 x DCRat, 1 x Lucifer)
ssdeep 6144:63YrOAZNgmTkXq1pNJPW/4NALz/a8J52kSD73NN1SGeO8dDniXggExkAJt5vGfgJ:HrRZNBTSqKi6bF52ks4GyniQlaAxAwq
TLSH T1A08423B9E5E6B1F6D8E86C396C4A7404048C78C312E04B9CC9197EFB275BDCF611A58E
TrID 40.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
12.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.0% (.EXE) Win32 Executable (generic) (4504/4/1)
5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe xworm


Avatar
abuse_ch
XWorm C2:
51.178.39.162:1177

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
51.178.39.162:1177 https://threatfox.abuse.ch/ioc/1668985/

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
0ff05fe7afc2ffab2e2e3527e2a34918.exe
Verdict:
Malicious activity
Analysis date:
2025-12-07 18:07:20 UTC
Tags:
auto-reg auto-startup
Link:
https://app.any.run/tasks/0ae0af92-17c7-4c46-baa0-a3f84ec451b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42931/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6935c217c61465c74cbc0ebe
Tags:
corrupt xtreme virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a window
Using the Windows Management Instrumentation requests
Launching a process
Creating a process with a hidden window
Forced system process termination
Сreating synchronization primitives
Unauthorized injection to a system process
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-02T09:45:00Z UTC
Last seen:
2025-12-02T21:00:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Alien.ajun HEUR:Trojan-Downloader.Script.Generic Trojan.JS.SAgent.sb
Link:
https://opentip.kaspersky.com/d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3269b47b-59bb-45a6-b8b9-99b6e52feb57
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1828488
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Detected unpacking (changes PE section rights)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Protects its processes via BreakOnTermination flag
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Uses schtasks.exe or at.exe to add and modify task schedules
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1828488 Sample: VVxbUXTN6w.exe Startdate: 07/12/2025 Architecture: WINDOWS Score: 100 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 13 other signatures 2->68 10 VVxbUXTN6w.exe 7 2->10         started        14 system32.exe 2->14         started        16 system32.exe 2->16         started        18 4 other processes 2->18 process3 file4 56 C:\Users\user\AppData\Local\Temp\...\93E6.vbs, data 10->56 dropped 80 Detected unpacking (changes PE section rights) 10->80 20 cscript.exe 1 2 10->20         started        23 conhost.exe 10->23         started        82 Contains functionality to prevent local Windows debugging 14->82 signatures5 process6 signatures7 70 Writes or reads registry keys via WMI 20->70 72 Writes registry values via WMI 20->72 25 powershell.exe 18 20->25         started        process8 signatures9 76 Writes to foreign memory regions 25->76 78 Injects a PE file into a foreign processes 25->78 28 AppLaunch.exe 1 6 25->28         started        33 AppLaunch.exe 25->33         started        35 conhost.exe 25->35         started        process10 dnsIp11 60 51.178.39.162, 1177, 49697, 49698 OVHFR France 28->60 58 C:\Users\user\AppData\Roaming\system32.exe, PE32 28->58 dropped 84 Protects its processes via BreakOnTermination flag 28->84 86 Adds a directory exclusion to Windows Defender 28->86 37 powershell.exe 23 28->37         started        40 powershell.exe 21 28->40         started        42 powershell.exe 28->42         started        44 2 other processes 28->44 88 Bypasses PowerShell execution policy 33->88 90 Uses schtasks.exe or at.exe to add and modify task schedules 33->90 file12 signatures13 process14 signatures15 74 Loading BitLocker PowerShell Module 37->74 46 conhost.exe 37->46         started        48 conhost.exe 40->48         started        50 conhost.exe 42->50         started        52 conhost.exe 44->52         started        54 conhost.exe 44->54         started        process16
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/0ff05fe7afc2ffab2e2e3527e2a34918
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51
Threat name:
Win32.Trojan.Ulise
Create hunting rule
Status:
Malicious
First seen:
2025-12-04 23:29:26 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2jzwkt6s62ulx3thmfw4mbrbrftasokhdshbo5wsbfrtq3nr3ziq._file
Verdict:
malicious
Label(s):
unc_loader_048
Create hunting rule
Similar samples:
error
XWorm
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence rat trojan
Link:
https://tria.ge/reports/251207-wpt4wssqem/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Drops startup file
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
51.178.39.162:1177
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2f0e0648-fd54-462f-ba4c-2f9493c9ff6f
Unpacked files
SH256 hash:
d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51
MD5 hash:
0ff05fe7afc2ffab2e2e3527e2a34918
SHA1 hash:
147e3589230991ddb46c512396da22f259099b8b
Link:
https://www.unpac.me/results/57cb2a3d-8e47-46f9-9115-26f5bda95c8d/
SH256 hash:
ffeb2e04761c6f84654abf2d0a09318a5b62777f601feed6ff3ec489e193d39d
MD5 hash:
a95c871a66a6b4aea7b8ae3aab2433bc
SHA1 hash:
15dc2274d60182ec6fb148dbd09ff405be8f5f4c
Link:
https://www.unpac.me/results/57cb2a3d-8e47-46f9-9115-26f5bda95c8d/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d273654fd2f6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d273654fd2f6a8bbee67616dc6062189660939471c8e1776d20963386db1de51

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
Rule name:win_xworm_bytestring
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects bytestring present in unobfuscated xworm
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42931/

Comments