MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52
SHA3-384 hash:	75828f016c4d5d0b63213ac648aa24c8079883aee64b4ac409a8cee57c66b9ba2da944e9bbce8cf1e387b52ebbb244ae
SHA1 hash:	4d519f33eb6ad3bb3979624d6f3e5b36381fb7d4
MD5 hash:	61abe5b274a31c313f2e4f86e91a3609
humanhash:	gee-sodium-low-indigo
File name:	nettt.bat
Download:	download sample
Signature	XWorm Create hunting rule
File size:	1'630 bytes
First seen:	2026-06-26 18:14:58 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	48:+W/0Gg13xgaycslSSRwb6XF+jlRgaCLcSd:pM3xga9slVKegjlRga2nd
Threatray	1'867 similar samples on MalwareBazaar
TLSH	T1C831DF46402E4D2FC3B5557ADEE235856687C063C85C5DCA799DC7082F7216B1B22FCA
Magika	batch
Reporter	BastianHein
Tags:	bat xworm

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

nettt.bat

Verdict:

Malicious activity

Analysis date:

2026-06-26 18:13:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/db358f30-a246-4e73-ba3c-b6243eb852ac

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72148/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3ec14a1548daf709fa0d63

Tags:

shell virus sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Сreating synchronization primitives

Creating a file

Unauthorized injection to a recently created process

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm base64 config-extracted crypto evasive explorer fingerprint lolbin lolbin powershell reconnaissance regedit remote-config taskkill timeout xworm

Link:

https://www.filescan.io/uploads/6a3ec1cfb0c543827ea1a3f4/reports/b29eba6c-8234-4834-9a4c-fc77a897ecf9/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52

Verdict:

Clean

File Type:

unix shell

First seen:

2026-06-26T14:55:00Z UTC

Last seen:

2026-06-26T15:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52/results?tab=lookup

Score:

15%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52/

Verdict:

Malicious

Threat:

Family.XMRIG

Link:

https://tip.neiki.dev/file/f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7aa5urn4pu3mhka3pir6ytwylxvj5fnyftzkoxx7wamu5joqlnja._file

Verdict:

malicious

Label(s):

xworm

unc_loader_055

XWorm

32bd0facd51f470e833edf85d93e2c36e90e2ff7824c981d795950d92663cd05

XWorm

a86aec200ab50bc3a739feb4954f02ab7ff503d02650ba50d154a25da92e8478

XWorm

be47b60d0203fbf8aac0aabee21f7aa2e90ca5d17363576c3ee9b1d6efd63f14

XWorm

cc4f4e1466183b11cfda923915e34cfd338cbf87a656d911120ceb784846d334

XWorm

e59f8ad1238df3f4da6140834e44391806267bd15b1b6d14efdfaa131b35da09

XWorm

e75983a3e7de409a67f9cb4d29aeae676234e4ff9a0731f932b68e653c64e0fe

XWorm

error

XWorm

+ 1'857 additional samples on MalwareBazaar

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xmrig family:xworm defense_evasion discovery execution miner persistence rat trojan upx

Link:

https://tria.ge/reports/260626-wv93asdz6r/

Behaviour

Delays execution with timeout.exe

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Launches sc.exe

Suspicious use of SetThreadContext

UPX packed file

Contacts third-party web service commonly abused for C2

Creates new service(s)

Cryptocurrency Miner

Executes dropped EXE

Stops running service(s)

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

XMRig Miner payload

Detect Xworm Payload

Family: Xworm

Family: xmrig

Malware Config

C2 Extraction:

185.194.175.132:4445

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)