MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603
SHA3-384 hash: a3a320882d4ccd3c18d8b0153ec15bdd21232049d43f4c90260395db16198d6d6e6cd408a5f5dc98a6e50215bda01988
SHA1 hash: 333b0d00183393f7f67b41c146d61903ca4e14c3
MD5 hash: 33d31ec43b05fe6cc1c26a05f1fdc62d
humanhash: march-angel-kitten-chicken
File name:eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603
Download: download sample
Signature XWorm
Create hunting rule
File size:748'032 bytes
First seen:2026-06-08 09:33:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'011 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 12288:OxiO84x4ZIrK/b72Fzhqx2nJt7dX52ORca+PiRnwniOaEd3tlui60Us4rPSg7Mi+:GSI+ShqWJt7dPWNKIiOayt0i60g75
Threatray 187 similar samples on MalwareBazaar
TLSH T11DF412A82AA6D507C1A143340E72F3B517B91ED9F521D21B9FE87EDFB97AB504C08183
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/96d27e5b-1085-4af6-9e15-307ed96cc6e2/
Malware family:
n/a
ID:
1
File name:
eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603.exe
Verdict:
Malicious activity
Analysis date:
2026-06-08 09:44:48 UTC
Tags:
auto-reg xworm remote
Link:
https://app.any.run/tasks/d783106d-473b-438a-af6d-fc0ccdace6ef

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69823/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a268d81ae2f98c00a68c8c0
Tags:
virus msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Сreating synchronization primitives
Changing a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed vbnet
Link:
https://www.filescan.io/uploads/6a268d72554e843ff86406b1/reports/a2e1851b-8bed-48bc-95d3-a5ea06031736/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-12T05:45:00Z UTC
Last seen:
2026-06-04T12:50:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/02da8230-50e2-4503-a1b5-72642a7efb8d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603
Threat name:
Win32.Trojan.PurelogStealer
Create hunting rule
Status:
Malicious
First seen:
2026-05-12 09:01:34 UTC
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ly5rfxb5ul434ndiebsklhp6mvguo3yjmf6vwveua36bdi5mybq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
26de53aa1d8c9911d7ed6063d5923e72e96fc85acb5187de4adf2f7a6cff656d
XWorm
554c62ab2e1a0e8ae03f41a25a89b1d1528e228d85ce3b3e7d8d8cacae6e86e0
XWorm
585a0ca32449865172fbf22bf372bd32b7c7348b399a4b68053296a410bbf66c
XWorm
68af66991e125976da13a5f0ea7bb2c47c255ec742e848064a9486302bd9babe
XWorm
dcbd0cfd58ec447bbb0d1ea54a8a385e4938bd499fa7d0cba85f9ba95520c2bc
XWorm
error
XWorm
+ 177 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence rat trojan
Link:
https://tria.ge/reports/260608-lktbpabv4m/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
151.244.232.26:443
Unpacked files
SH256 hash:
eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603
MD5 hash:
33d31ec43b05fe6cc1c26a05f1fdc62d
SHA1 hash:
333b0d00183393f7f67b41c146d61903ca4e14c3
Link:
https://www.unpac.me/results/41832cae-5fe7-451d-bf43-fd568135b0ce/
SH256 hash:
36e104a2d5360227c825dd84da417deef4b340f83148729bd53e3fcf6e4be6d7
MD5 hash:
4b8323c46dbc07774ca3a3e00d988475
SHA1 hash:
2d1890a8b4cafac630b0b737956d33d37d090918
Link:
https://www.unpac.me/results/41832cae-5fe7-451d-bf43-fd568135b0ce/
SH256 hash:
5cd363fc5958bf51be0520e2ae4c9640b3da562a654a961951e5de07b2619a72
MD5 hash:
d4446718e1fac3191203d74b0a2030b0
SHA1 hash:
328b1a587e88dc48315fd70bc06d3953dc2dd4f8
Link:
https://www.unpac.me/results/41832cae-5fe7-451d-bf43-fd568135b0ce/
SH256 hash:
5d251c04ea02d811a6fd2b159061c1b1d64e0aa4b3eb1fa8ba591d29d8430ed8
MD5 hash:
ca60870d5f2012d05eb7bc388f77323c
SHA1 hash:
fa06c5c3c3c7e8180d901ff2b07a9cad35435bd4
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
Link:
https://www.unpac.me/results/41832cae-5fe7-451d-bf43-fd568135b0ce/
Parent samples :
67851f424ccbe66c1d79bdb2c7dac0bcb2f833d6225014ddbf143974d5d96766
eaf1d896e1ed17cdf1a34103252ceff32a6a3b784b0beadaa4a037e08d1d6603
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/eaf1d896e1ed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69823/

Comments