MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffaa84c3d45d849b133c1127a7691558a7086c6370643ad40016c9629b89e505. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffaa84c3d45d849b133c1127a7691558a7086c6370643ad40016c9629b89e505
SHA3-384 hash: a7924faf363726c9fd04cbc9c83cc4472e5e5da9d7d5ff38f2306940bee0eda3e55da59185763b840c6951772142cf43
SHA1 hash: 2cbe36112df4e29f7d197e70bccbc801cc69ea44
MD5 hash: 28c2d3209dafdfd1459f5074c2a1288d
humanhash: mars-nevada-harry-freddie
File name:wtf.cmd
Download: download sample
Signature XWorm
Create hunting rule
File size:245 bytes
First seen:2026-03-16 20:43:38 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/plain
ssdeep 6:sny2jJETe6or6RUhDk9FCXehzQ98AV/jLdhouc2cJoymhD9GdH:snxjUe6+thcSehzs8AV/jJhouEajhwdH
TLSH T126D05E67C001341FC7A4949FB8D6AE167787D44DC309A414E1B7A8150891378C629D26
Magika powershell
Reporter abuse_ch
Tags:cmd xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
211
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.PUA.IA.Suspicious.61927937.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69b68c3d88c80c01586a69f6
Tags:
vmdetect xtreme shell sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm evasive fingerprint powershell
Link:
https://www.filescan.io/uploads/69b86ba14ec2f522cc4ba1d4/reports/bf8375ab-40d5-4881-816a-5992eb0531e0/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/ffaa84c3d45d849b133c1127a7691558a7086c6370643ad40016c9629b89e505
Verdict:
Malicious
File Type:
ps1
Detections:
PDM:Trojan.Win32.Generic UDS:DangerousObject.Multi.Generic Trojan-Downloader.Agent.HTTP.C&C Trojan.Win32.PowerShell.c NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C
Link:
https://opentip.kaspersky.com/ffaa84c3d45d849b133c1127a7691558a7086c6370643ad40016c9629b89e505/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1884570
Signature
Bypasses PowerShell execution policy
Installs new ROOT certificates
Joe Sandbox ML detected suspicious sample
Performs DNS queries to domains with low reputation
Sigma detected: Suspicious PowerShell Parameter Substring
Behaviour
Behavior Graph:
Download SVG
Score:
58%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/ffaa84c3d45d849b133c1127a7691558a7086c6370643ad40016c9629b89e505
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffaa84c3d45d849b133c1127a7691558a7086c6370643ad40016c9629b89e505/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/ffaa84c3d45d849b133c1127a7691558a7086c6370643ad40016c9629b89e505
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=76vijq6ulwcjwez4cet2o2ivlctqq3ddobsdvvaac3ewfg4j4ucq._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm execution rat trojan
Link:
https://tria.ge/reports/260316-zh9gsacv8l/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
45.157.233.46:25565
Dropper Extraction:
https://mountaingoats4sale.xyz/AV12.exe
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ffaa84c3d45d849b133c1127a7691558a7086c6370643ad40016c9629b89e505

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:WIN_FileFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects FileFix social engineering technique that launches chained PowerShell and PHP commands from file explorer typed paths
Reference:FileFix social engineering with PowerShell and PHP commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments