Hello,

I downloaded a sample from Malwarebazaar. It was a .bat file around 208.38 KB. I set it up into AnyRun, and started the analysis.

---

Threat Type: XWorm v6.5 (RAT) + Stealer sold as Malware-as-a-Service. Capabilities include credential theft, keylogging, screenshot capture, file exfiltration, and hijacking of crypto wallets and accounts.

Execution Process:

1. .bat file runs -> checks for sandbox using findstr.exe
2. Uses certutil.exe to Base64-decode an embedded payload
3. cscript.exe executes decoded VBScript, dropping svchost.exe (fake) to %TEMP%
4. Payload launches, copies itself to %APPDATA%\main.exe and the startup folder for persistence
5. Connects to C2 and sends system fingerprint via Telegram Bot API

IOCs

Dropper SHA256: dea6cfb3234780ceeea718787e027cc6d2de18cfead1f8cc234e0ad268987868

Dropped Payload SHA256: 7f2b0ffbc5b149b4f9858589763bacdebf63ea1b3a00532e9278d613f75462ea

• C2: 23.160(.)168.174:3212
• AES Key: <666666>
• Mutex: XUH24Sz2TPub4OF4
• USB drop name: XWorm V6.5 by c3lestial(.)fun

Full Analysis: https://app.any.run/tasks/1cd22443-8259-49c0-8e6e-a0ca93b0371c