MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e284f6a66413a2f9084bb75b132da2a32384ce0f45dec45e95d219f58bcec86a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e284f6a66413a2f9084bb75b132da2a32384ce0f45dec45e95d219f58bcec86a
SHA3-384 hash: 643e46a1a6ec3ae6dcf1bc4f52ddf0914310ecd41c4cf01592a4189d724b2ffaf679a166d0e244033d9732375898f89a
SHA1 hash: ad88066730c9db11a61c8f6aa94c2b39e7c87d39
MD5 hash: 62f9aab402cd7a8d1843e1928be9ebb3
humanhash: bravo-mockingbird-island-four
File name:RFQ_20-10-2025_Product-Details_Spec-Drawing.pdf.bat
Download: download sample
Signature XWorm
Create hunting rule
File size:267'860 bytes
First seen:2025-10-24 12:51:24 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 3072:AWM8f9v7ildY9eYoSeRU4+bWxdh2HrNwtbHFpnVZB3ZCOhL:A2lTixRz+Oh2HrUHnnVZB39
Threatray 1'224 similar samples on MalwareBazaar
TLSH T13544B56785966B56FE0CAC9C9707CA8630CB47B1A315A91AB5CFCA0F6C0778C0A1FD47
Magika batch
Reporter James_inthe_box
Tags:bat exe xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ_20-10-2025_Product-Details_Spec-Drawing.pdf.bat
Verdict:
Malicious activity
Analysis date:
2025-10-24 12:52:20 UTC
Tags:
susp-powershell xworm
Link:
https://app.any.run/tasks/7710493a-fb7d-4796-b76f-7dcbb7d1d27c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/34037/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68fb76603bdc93eb0563d4d7
Tags:
keylog shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching cmd.exe command interpreter
Creating a file
Launching a process
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Setting a global event handler for the keyboard
Connection attempt to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 batch evasive masquerade obfuscated powershell
Link:
https://www.filescan.io/uploads/68fb7661fd2d7e012f4d30ed/reports/57bf5bee-0f1d-49a0-9696-45e67ba35d3e/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e284f6a66413a2f9084bb75b132da2a32384ce0f45dec45e95d219f58bcec86a
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-19T20:25:00Z UTC
Last seen:
2025-10-26T08:00:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Backdoor.MSIL.XWorm.a Backdoor.MSIL.Agent.sb Trojan.BAT.Agent.sb HEUR:Trojan.PowerShell.Tesre.sb HEUR:Trojan.BAT.Tesre.gen Trojan.PowerShell.AmsiBypass.sb Backdoor.Agent.TCP.C&C Backdoor.MSIL.XWorm.b
Link:
https://opentip.kaspersky.com/e284f6a66413a2f9084bb75b132da2a32384ce0f45dec45e95d219f58bcec86a/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e284f6a66413a2f9084bb75b132da2a32384ce0f45dec45e95d219f58bcec86a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e284f6a66413a2f9084bb75b132da2a32384ce0f45dec45e95d219f58bcec86a/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/e284f6a66413a2f9084bb75b132da2a32384ce0f45dec45e95d219f58bcec86a
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-20 01:43:04 UTC
File Type:
Text (Batch)
AV detection:
10 of 37 (27.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4kcpnjtecorpscclw5nrglncumryjtqpixpmixuv2im7lc6ozbva._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
153c5641badc8df2740041f4dcbceb18fed6560af9fb704776304c96c9974bcf
XWorm
60a6d2666a2fcff382041c20273f99cc13f1998d11522fb772eac2aeed83f37c
XWorm
677536b7f1eb664ef689a5b418a6a38f75bac30e1f4a4b8d7e9e44a3888f0027
XWorm
ae4c0ef46c195eca51369358673a9d8efed3fb69f92bce3d0763eec59e0d9bae
XWorm
b57aff2eb48e3121344494e3e4d60ce0d357c48a2a35806e9024fcac9202ebcd
XWorm
dd571605c43f67c667cf409ddffd8fadbe022d45239f7aa61e584f0c2cd274f4
XWorm
dd5f4cf43236b8b7c89369b8a42cf5917f41c88a5d3d785d596058f2b203ac72
XWorm
ec145d51cb891b1e9a1e31088c0803371b5804baee1e766016b0a6f6e471f385
XWorm
error
XWorm
+ 1'214 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm execution rat trojan
Link:
https://tria.ge/reports/251024-p3txqagr31/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
107.172.44.153:6000
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e284f6a66413a2f9084bb75b132da2a32384ce0f45dec45e95d219f58bcec86a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/34037/

Comments