MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017
SHA3-384 hash: 8d9cf8a77623a4dc6449ab5100d3a384dda5cd662467587770af6ad39535f435030924612df3e1dc7472c3582a0a2312
SHA1 hash: b7aa76ee644aea0d4453a2b0bd1385491ba5208b
MD5 hash: c24b05b25c28e5e7a1231a62be80bc12
humanhash: salami-grey-pasta-texas
File name:XWorm v6.4 Edition.exe
Download: download sample
Signature DarkComet
Create hunting rule
File size:16'358'830 bytes
First seen:2026-04-26 16:30:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dcaf48c1f10b0efa0a4472200f3850ed (59 x BlankGrabber, 30 x Efimer, 22 x NetSupport)
ssdeep 393216:dAZYacd0h/udnBG0+nReke612FAL47KfqLfEuECMc+8ADtAiatsh:mZvHudnh+nRey4KS7jECMIgtAiatsh
TLSH T161F6330CB7C025A6F5F79631C2539B269272F2071B3097DF4391442B6EA3AF51A7A7E0
TrID 70.9% (.EXE) InstallShield setup (43053/19/16)
10.7% (.EXE) Win64 Executable (generic) (6522/11/2)
8.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.3% (.EXE) OS/2 Executable (generic) (2029/13)
3.3% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 96cc69f0706dcc96 (1 x DarkComet)
Reporter Ling
Tags:DarkComet exe xred XRedRAT


Avatar
CNGaoLing
XRedRAT
IOC (Domain xred.mooo.com)

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
PyInstaller
Details
PyInstaller
a compiled assembly and a Python version
Link:
https://research.acce.ciphertechsolutions.com/results/7d87f410-1217-46d2-a364-6bec2a58cd1f/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-04-26 16:34:33 UTC
Tags:
auto-reg xred backdoor python delphi netreactor rat dyndns pulsar
Link:
https://app.any.run/tasks/d6ed3736-e2e0-4269-abb9-d1c821375874

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
StormKitty
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63665/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ee3dd34aed15d07930bb5b
Tags:
vmdetect autorun emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Creating a window
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Сreating synchronization primitives
Searching for synchronization primitives
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Searching for the window
Moving a recently created file
Modifying an executable file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Launching a process
Launching the default Windows debugger (dwwin.exe)
Running batch commands
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Infecting executable files
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-04-26T12:37:00Z UTC
Last seen:
2026-04-26T20:47:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.MSIL.SheetRat.gen Trojan.Win32.Agent.sb Backdoor.MSIL.XWorm.a HEUR:Trojan-Downloader.MSOffice.Agent.gen Trojan-PSW.MSIL.Stealer.sb HEUR:Trojan.MSIL.Agent.gen HEUR:Exploit.MSIL.BypassUAC.c Trojan.MSIL.Inject.sb Trojan.MSIL.Agent.sb Backdoor.PulsarRAT.TCP.C&C Backdoor.MSIL.PulsarRAT.sb HEUR:Trojan.Win32.Generic HEUR:Trojan-PSW.MSIL.Stealer.gen Trojan-PSW.MSIL.Stealerium.sb Trojan-PSW.MSIL.Agent.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Coins.sb HackTool.MSIL.Agent.sb HEUR:Backdoor.MSIL.XWorm.gen Trojan.Win32.Vimditator.sb Trojan.MSIL.DOTHETUK.sb Exploit.Win32.BypassUAC.sb HEUR:Trojan.Script.Generic HEUR:HackTool.MSIL.EtwHook.gen Trojan.Win32.XRed.sb Trojan.MSIL.DInvoke.sb Trojan-PSW.MSIL.DiscoStealer.sb Trojan.Win32.Agentb.jrhy HEUR:Trojan.MSIL.Convagent.gen HEUR:Trojan-Ransom.Win32.Gen.gen HEUR:Trojan-Banker.MSIL.ClipBanker.gen Backdoor.MSIL.VenomRAT.a Backdoor.MSIL.Crysan.sb HEUR:Trojan-Downloader.Script.Generic Backdoor.Win32.DarkKomet.hqxy Trojan-PSW.Win32.Agent.sb Backdoor.MSIL.XWorm.b
Link:
https://opentip.kaspersky.com/ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017/results?tab=lookup
Malware family:
XRed
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1bcd1df0-9d77-42bb-8923-fe139b20f5a6
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/c24b05b25c28e5e7a1231a62be80bc12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017/
Verdict:
Malicious
Threat:
Family.XRED
Link:
https://tip.neiki.dev/file/ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-04-26 16:32:00 UTC
File Type:
PE+ (Exe)
Extracted files:
450
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=547ed3er7c7bi3bvrazb7gf6ru63hez5hcarcjkurghh535ywalq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
xredbackdoor
Create hunting rule
stormkitty
Create hunting rule
hiddenvnc
Create hunting rule
quasarrat
Create hunting rule
Similar samples:
error
DarkComet
Result
Malware family:
xred
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:quasar family:stormkitty family:xred backdoor defense_evasion discovery execution persistence pyinstaller rat spyware stealer trojan
Link:
https://tria.ge/reports/260426-t1cymsft3q/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in System32 directory
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Async RAT payload
Family: AsyncRat
Family: Quasar RAT
Family: StormKitty
Family: Xred
Quasar payload
StormKitty payload
Malware Config
C2 Extraction:
xred.mooo.com
Unpacked files
SH256 hash:
ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017
MD5 hash:
c24b05b25c28e5e7a1231a62be80bc12
SHA1 hash:
b7aa76ee644aea0d4453a2b0bd1385491ba5208b
Link:
https://www.unpac.me/results/ecc0247e-e05f-40c8-90b7-c7a81aae6e53/
SH256 hash:
052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 hash:
32da96115c9d783a0769312c0482a62d
SHA1 hash:
2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
Link:
https://www.unpac.me/results/ecc0247e-e05f-40c8-90b7-c7a81aae6e53/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkComet

Executable exe ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/63665/

Comments