MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e56837db56867e394ea649124f410a11c9086df6476ce168e6943376ae6c89b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 17
| SHA256 hash: | e56837db56867e394ea649124f410a11c9086df6476ce168e6943376ae6c89b9 |
|---|---|
| SHA3-384 hash: | 6e38069e4563dc747dbda8b1181b3a8b304fef3aa301f7f73748349aff30e1a97c830830f430b8e21fc242305a4c47bb |
| SHA1 hash: | a77e18f206a9504863f9dc184b81949a1d7e4fe3 |
| MD5 hash: | 3912964ca1d8eb17c2e142e2d2eb24cf |
| humanhash: | winner-oranges-wisconsin-sierra |
| File name: | Q0ZyulW.exe1 |
| Download: | download sample |
| Signature | XWorm |
| File size: | 6'029'824 bytes |
| First seen: | 2025-03-18 12:56:45 UTC |
| Last seen: | 2025-03-19 00:36:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 98304:b+unPNN/N91h2eDZQjL7sU8I5DKBWoClkRGJewd8Y3evBQ9LtYVrEx3/o6ETgKb5:b+6h9GeDVI5DKBWZlkgJedYs6LtYdEhV |
| Threatray | 9 similar samples on MalwareBazaar |
| TLSH | T1415633E73680EB15E9190932E13BE7BE1537FE1A6A004A2F20DC7C9B3636B00F55D569 |
| TrID | 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | 32f4c48cceecf0b1 (1 x XWorm, 1 x AsyncRAT) |
| Reporter |  KatzenTech |
| Tags: | exe xworm |
Intelligence
File Origin
# of uploads :
2
# of downloads :
411
Origin country :
RUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Q0ZyulW.exe1.exe
Verdict:
Malicious activity
Analysis date:
2025-03-18 13:08:13 UTC
Tags:
autorun-sched remote xworm themida
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
91.7%
Tags:
micro shell agile
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
DNS request
Connection attempt
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed packed packer_detected
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Result
Threat name:
XWorm
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected XWorm
Behaviour
Behavior Graph:
Score:
99%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Malgent
Status:
Malicious
First seen:
2025-03-18 12:07:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
52
AV detection:
20 of 24 (83.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
xworm
unc_loader_037
Similar samples:
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xworm defense_evasion discovery execution rat themida trojan
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Themida packer
Command and Scripting Interpreter: PowerShell
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
httpss.myvnc.com:1907
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
e56837db56867e394ea649124f410a11c9086df6476ce168e6943376ae6c89b9
MD5 hash:
3912964ca1d8eb17c2e142e2d2eb24cf
SHA1 hash:
a77e18f206a9504863f9dc184b81949a1d7e4fe3
SH256 hash:
1e9e1c16c7bf4350466a98bfe612bc72878923c56843336f5012f73d5c96e54b
MD5 hash:
c22f17c185dc79125579451ebefb78f5
SHA1 hash:
aa9749aa2e4febb5354ef899ade733ac7a21ff59
Detections:
INDICATOR_EXE_Packed_Themida
INDICATOR_EXE_Packed_AgileDotNet
SH256 hash:
b26495d56dd8256d0699753298aee52ddd9610ddfa31ba818369ffdaadff2455
MD5 hash:
5bb34b4de9fc4acb174899e4c58f6113
SHA1 hash:
521eaf1c5e4b8d39ee88598c16a505ca496d200c
Detections:
INDICATOR_EXE_Packed_SmartAssembly
SH256 hash:
ea9d95091c01807e2887f952eafbcb8578430a0a30aa55647f4c379bfd9ab525
MD5 hash:
765fe075e8856f578a65307c123358ec
SHA1 hash:
b08d1a68b96b6831f07498dad431e65d596dc262
Detections:
win_xworm_w0
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
MALWARE_Win_AsyncRAT
MALWARE_Win_XWorm
SH256 hash:
18d9e11d134ec71309c34a7fab9b7a4134b3c7663a1d56739bba579e646b4026
MD5 hash:
f69e95b716084453274d96a4bb6c3987
SHA1 hash:
f14c8aa6852cd00e747447286357490efdfeceb5
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
Malware family:
XWorm
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Check_OutputDebugStringA_iat |
|---|
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | INDICATOR_EXE_Packed_AgileDotNet |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with Agile.NET / CliSecure |
| Rule name: | INDICATOR_EXE_Packed_Themida |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with Themida |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | vmdetect |
|---|---|
| Author: | nex |
| Description: | Possibly employs anti-virtualization techniques |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.