MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 15

Intelligence 15 IOCs YARA 17 File information Comments

SHA256 hash:	f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343
SHA3-384 hash:	984e7b87f61a8cf6c26610db859431a079e6ffa850039cc7716e2525ca2e2843aca0b09592bdd9db65859c7c884a9711
SHA1 hash:	bd14cf27c2c384c941770290f1fe1f4737cd9099
MD5 hash:	7bf1d00691f5b41d4a3cc419c48eb32a
humanhash:	mango-bulldog-twelve-happy
File name:	f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343
Download:	download sample
Signature	XWorm Create hunting rule
File size:	690'688 bytes
First seen:	2026-11-09 08:20:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'364 x AgentTesla, 20'869 x Formbook, 12'418 x SnakeKeylogger)
ssdeep	12288:yXWLzEGsM2zVfz9qgeGwN1x4Lk6pp2NPzWGRDrGBlYzRAom9Rzcju:2Wq9t9qgeGwNO+7WqnWl+qUju
TLSH	T16BE4F1582B75D71BD82AA3F45A72F17813B96EEA3921D2039FD9ADEB3536F000C40593
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe xworm

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/1da1a6ca-5aea-4e5d-b126-ead40e55aada/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-09 17:15:07 UTC

Tags:

rgbloader loader

Link:

https://app.any.run/tasks/618f806f-df8f-406d-8b55-4323ecf1bb62

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XWorm

Link:

https://www.capesandbox.com/analysis/98389/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1c649ac89c90fc65aa0ca

Tags:

injection virus micro

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-16T04:53:00Z UTC

Last seen:

2026-11-05T04:45:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343/results?tab=lookup

Gathering data

Result

Threat name:

XWorm

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2002192

Behaviour

Behavior Graph:

n/a

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.38 Win 32 Exe x86

Link:

https://app.malva.re/file/7bf1d00691f5b41d4a3cc419c48eb32a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2026-10-16 11:05:43 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 36 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6tt7z6uzrhtgc7cqgpu2p6myfpxwy3fu3bgy7iydaoehzcev6nbq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/261109-j8n1rsa18z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Malware Family:

n/a

Verdict:

Suspicious

Tags:

injector

YARA:

n/a

Link:

https://app.threat.zone/submission/9e34385b-545b-4cc8-9880-756a713ab1a7

Malware Family:

msil

Malicious:

True

Tags:

dotnet polymorphic peexe

Link:

https://intel.virussign.com/intelligence/file/f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343

Unpacked files

SH256 hash:

f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343

MD5 hash:

7bf1d00691f5b41d4a3cc419c48eb32a

SHA1 hash:

bd14cf27c2c384c941770290f1fe1f4737cd9099

Link:

https://www.unpac.me/results/40bc7c3e-8307-4c5a-a6f6-2b4ce5a95760/

SH256 hash:

d41d9461ce157e041b455f9b4421722a7f44b56395cf709eb79ecff3eeedc879

MD5 hash:

620f4a3c53ba570b3cd200bf73df5e7a

SHA1 hash:

2f0a463b13c31b270ae8fb37957acd49a941e5a6

Link:

https://www.unpac.me/results/40bc7c3e-8307-4c5a-a6f6-2b4ce5a95760/

SH256 hash:

ecf7a95d2c5d0b1fdd89865f4dde0bf8e22a616d3a4f686da00ab7958a9107ce

MD5 hash:

86dcd3d15c464d5732dd02b0eea4dd27

SHA1 hash:

582096ecb0e27227d4a27ae0960436dff69ddc12

Link:

https://www.unpac.me/results/40bc7c3e-8307-4c5a-a6f6-2b4ce5a95760/

SH256 hash:

66cb5858e8375a197025edf901c6e2cfcf0098b46e810414feb18836000e45e2

MD5 hash:

1aab2f61f117f44505f373947d5a08a3

SHA1 hash:

a6fa4f462697070afac8a605c680cd133af8445e

Link:

https://www.unpac.me/results/40bc7c3e-8307-4c5a-a6f6-2b4ce5a95760/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f4e7fcfa9989e6617c5033e9a7f9982bef6c6cb4d84d8fa30303887c8895f343

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	DotNet_RGB_Embedded_AssemblyLoader_Hunt Create hunting rule
Author:	ShadowOpCode
Description:	Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	VIGIA_Formbook_17e263ff Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	b2bcacf7-0124-4f63-ad19-69b0102fe4c4 - Conjunctive sample-specific and variant indicators
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_e53b23f6 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	RemcosRAT indicators with an original-sample recovery pathway
Reference:	https://vigia.bisite.es/

Rule name:	win_dotnet_vb_stealer_rat Create hunting rule
Author:	Arrbat
Description:	Detects .NET/VB executables with stealer/RAT capabilities (sockets, HTTP, processes, registry, etc).

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/98389/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample