MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e43399dac848eb1744215553c6e5ec32127af5974c9482f970bfaea0fe60d6a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 9


Intelligence 9 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e43399dac848eb1744215553c6e5ec32127af5974c9482f970bfaea0fe60d6a4
SHA3-384 hash: df90417235a71f29fc495050aff9fab1102431fa32cf88122ac9c8b46c6f46b5c061132c2458de41f8c78a33858127ca
SHA1 hash: c1f1a479bb2051a6c961f245f9b0510fc946dbc3
MD5 hash: 1d474e5c29dcbc962c7a481a33a33016
humanhash: uranus-north-oven-crazy
File name:185.7.214.54 b.ps1
Download: download sample
Signature XWorm
Create hunting rule
File size:569 bytes
First seen:2025-02-17 19:38:41 UTC
Last seen:2025-02-23 18:57:03 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12:FNxTKbeskGMbVzc9xlpEq2f18fDFXSP5xyG5C95BFVm1A0P0z6zhnnyVMnN:1TmFkGoVzcdaqMYhSB5a5BFVm1A0P5hf
Threatray 2'240 similar samples on MalwareBazaar
TLSH T1F4F08B6D3E6B076AD2259D2FA2C08B1D253A980654B538EAB6C637020D2B1705D4C1CE
Magika powershell
Reporter JAMESWT_WT
Tags:185-7-214-54 booking ClickFix FakeCaptcha ps1 Spam-ITA xworm

Intelligence

File Origin
# of uploads :
3
# of downloads :
164
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67b3911aa0fd713c335b80e5
Tags:
asyncrat autorun
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade persistence
Link:
https://www.filescan.io/uploads/67b390621195447a80c498f3/reports/7ea021f2-1923-43e0-83f0-7c603457f8c1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e43399dac848eb1744215553c6e5ec32127af5974c9482f970bfaea0fe60d6a4
Result
Verdict:
UNKNOWN
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1617371
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Compiles code for process injection (via .Net compiler)
Found malicious URL file
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Drops script at startup location
Sigma detected: Powerup Write Hijack DLL
Suricata IDS alerts for network traffic
Writes to foreign memory regions
Yara detected Powershell download and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1617371 Sample: 185.7.214.54 b.ps1 Startdate: 17/02/2025 Architecture: WINDOWS Score: 100 51 Suricata IDS alerts for network traffic 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 15 other signatures 2->57 9 powershell.exe 15 20 2->9         started        14 notepad.exe 2->14         started        process3 dnsIp4 47 185.7.214.54, 49731, 49732, 80 DELUNETDE France 9->47 43 C:\Windows\Temp\cmd.bat, DOS 9->43 dropped 45 C:\Users\user\AppData\...\DeleteApp.url, MS 9->45 dropped 65 Compiles code for process injection (via .Net compiler) 9->65 16 cmd.exe 1 9->16         started        18 conhost.exe 9->18         started        file5 signatures6 process7 process8 20 powershell.exe 22 16->20         started        24 conhost.exe 16->24         started        file9 39 C:\Users\user\AppData\...\utjrej4l.cmdline, Unicode 20->39 dropped 41 C:\Users\user\AppData\Local\...\utjrej4l.0.cs, Unicode 20->41 dropped 59 Writes to foreign memory regions 20->59 61 Injects a PE file into a foreign processes 20->61 26 MSBuild.exe 20->26         started        29 MSBuild.exe 2 20->29         started        32 csc.exe 3 20->32         started        signatures10 process11 dnsIp12 63 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 26->63 49 185.7.214.108, 4411, 49733 DELUNETDE France 29->49 37 C:\Users\user\AppData\Local\...\utjrej4l.dll, PE32 32->37 dropped 35 cvtres.exe 1 32->35         started        file13 signatures14 process15
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e43399dac848eb1744215553c6e5ec32127af5974c9482f970bfaea0fe60d6a4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e43399dac848eb1744215553c6e5ec32127af5974c9482f970bfaea0fe60d6a4/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-02-17 19:37:41 UTC
File Type:
Text
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4qzztwwijdvrorbbkvj4nzpmgijhv5mxjskif6lqx6xkb7ta22sa._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
2a8290c18d10fa8a7e99575855b9fb8e734ea92b1aa7dce9840282c2657ba08c
XWorm
53a2f686422f9f71b69d3a9699661c96dc1375d490ea188d5141bb1e8ae89029
XWorm
706f0caff1321c7798d4daf06c2c18b7c25cf3237dc60a5045dca49c97e9f5cf
XWorm
73ec61886e1c072d872ca46322fe1619d27ac1a90f8652ee29c6b7ee0532ab9f
XWorm
80a21952b87d83eb419768268b334364ecab48dbb9cbe55b967ba9636e512cab
XWorm
95bd50b1c849b16159f239b176e9c48d97bc7d841441829ec974997a93cb4c1e
XWorm
d0ef84c36715bc834f68415f2b16ca2e8088141a83231f27c4a7d6285d4b6d1a
XWorm
error
XWorm
fbb6e25ede47737ad9d540192a46117ce42c6e24c7ce60d027e36ff49cba8213
XWorm
+ 2'230 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/250217-yc2djssnfx/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AsyncRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e43399dac848eb1744215553c6e5ec32127af5974c9482f970bfaea0fe60d6a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Methodology_Suspicious_Shortcut_Local_URL
Create hunting rule
Author:@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)
Description:Detects local script usage for .URL persistence
Reference:https://twitter.com/cglyer/status/1176184798248919044
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XWorm

PowerShell (PS) ps1 e43399dac848eb1744215553c6e5ec32127af5974c9482f970bfaea0fe60d6a4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3438240/
  
Delivery method
Distributed via web download

Comments