File name:

NixWare-Fix.zip

Full analysis: https://app.any.run/tasks/5416948c-dda9-4bf0-89c0-0972cbd63b4d
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 19:26:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remote
xworm
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=AES Encrypted
MD5:

11C7A86A6D9862F3988B48FF73E2ABEC

SHA1:

E35B4AADB47A1D3716AB627D44314F19BFE21A7E

SHA256:

68D905F072830D1924DA9B9B7491BA61B6037FE920EDB646056270839067F756

SSDEEP:

1536:qmurYqCbu1TUzm7OqUP+AV70m/FUeta52m:qbeGYa6qUP+20oFvtagm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • fix.exe (PID: 1280)

    • XWORM has been detected (YARA)

      • fix.exe (PID: 1280)

    • XWORM has been detected (SURICATA)

      • fix.exe (PID: 1280)

    • Uses Task Scheduler to run other applications

      • fix.exe (PID: 1280)

    • Changes the autorun value in the registry

      • fix.exe (PID: 1280)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • fix.exe (PID: 1280)

    • Executable content was dropped or overwritten

      • fix.exe (PID: 1280)

    • Reads security settings of Internet Explorer

      • fix.exe (PID: 1280)

    • Reads the date of Windows installation

      • fix.exe (PID: 1280)

    • The process executes via Task Scheduler

      • scvhost.exe (PID: 6272)
      • scvhost.exe (PID: 1164)
      • scvhost.exe (PID: 7896)
      • scvhost.exe (PID: 5020)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

    • Connects to unusual port

      • fix.exe (PID: 1280)

    • Contacting a server suspected of hosting an CnC

      • fix.exe (PID: 1280)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 7960)
      • cmd.exe (PID: 8116)
      • notepad.exe (PID: 3768)
      • cmd.exe (PID: 5244)
      • notepad.exe (PID: 5868)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7960)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 3768)
      • notepad.exe (PID: 5868)

    • Checks supported languages

      • fix.exe (PID: 1280)
      • scvhost.exe (PID: 6272)
      • qmhijs.exe (PID: 8080)
      • scvhost.exe (PID: 1164)
      • scvhost.exe (PID: 7896)
      • scvhost.exe (PID: 5020)

    • Reads the computer name

      • fix.exe (PID: 1280)
      • scvhost.exe (PID: 6272)
      • qmhijs.exe (PID: 8080)
      • scvhost.exe (PID: 1164)
      • scvhost.exe (PID: 7896)
      • scvhost.exe (PID: 5020)

    • Reads the machine GUID from the registry

      • fix.exe (PID: 1280)
      • scvhost.exe (PID: 6272)
      • scvhost.exe (PID: 1164)
      • scvhost.exe (PID: 7896)
      • scvhost.exe (PID: 5020)

    • Reads the software policy settings

      • slui.exe (PID: 7272)
      • slui.exe (PID: 5988)

    • Creates files or folders in the user directory

      • fix.exe (PID: 1280)

    • Process checks computer location settings

      • fix.exe (PID: 1280)

    • Checks proxy server information

      • slui.exe (PID: 5988)

    • Create files in a temporary directory

      • fix.exe (PID: 1280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(1280) fix.exe
C2SpyIgle-45124.portmap.io:45124
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexDY0o87wY9AdzDfqK
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2025:04:15 22:16:34
ZipCRC: 0x4a0741de
ZipCompressedSize: 56178
ZipUncompressedSize: 326656
ZipFileName: NixWare-Fix.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
23
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe winrar.exe rundll32.exe no specs cmd.exe conhost.exe no specs notepad.exe no specs cmd.exe no specs conhost.exe no specs #XWORM fix.exe slui.exe schtasks.exe no specs conhost.exe no specs scvhost.exe no specs svchost.exe notepad.exe no specs qmhijs.exe no specs qmhijs.exe scvhost.exe no specs scvhost.exe no specs qpbcru.exe no specs scvhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164"C:\Users\admin\AppData\Roaming\scvhost.exe"C:\Users\admin\AppData\Roaming\scvhost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nixware
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\scvhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1280fix.exeC:\Users\admin\Desktop\NixWare-Fix\fix.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nixware
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\nixware-fix\fix.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
XWorm
(PID) Process(1280) fix.exe
C2SpyIgle-45124.portmap.io:45124
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexDY0o87wY9AdzDfqK
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3364"C:\Users\admin\AppData\Local\Temp\qmhijs.exe" C:\Users\admin\AppData\Local\Temp\qmhijs.exe—fix.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\qmhijs.exe
c:\windows\system32\ntdll.dll
3768"C:\WINDOWS\System32\NOTEPAD.EXE" C:\Users\admin\Desktop\NixWare-Fix\start.batC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4024"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\NixWare-Fix.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4896"C:\Users\admin\AppData\Local\Temp\qpbcru.exe" C:\Users\admin\AppData\Local\Temp\qpbcru.exe—fix.exe
User:
admin
Company:
Viber Media S.à r.l.
Integrity Level:
MEDIUM
Description:
Viber
Version:
25.0.2-0-gf422d6c88ef
Modules
Images
c:\users\admin\appdata\local\temp\qpbcru.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
5020"C:\Users\admin\AppData\Roaming\scvhost.exe"C:\Users\admin\AppData\Roaming\scvhost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nixware
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\scvhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5244C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\NixWare-Fix\start.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
Total events
5 100
Read events
5 074
Write events
26
Delete events
0

Modification events

(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\NixWare-Fix.zip
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(4024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
3
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1280fix.exeC:\Users\admin\AppData\Local\Temp\qpbcru.exe —
MD5:—
SHA256:—
7960WinRAR.exeC:\Users\admin\Desktop\NixWare-Fix\start.battext
MD5:9F9E3DE780A7AA56AD8350DD57F4E5A2
SHA256:1103A090BD63ECBB8354AB561AABAFCD5AEDE62BC372995CEBBD2B8FA1D258F2
7960WinRAR.exeC:\Users\admin\Desktop\NixWare-Fix\fix.exeexecutable
MD5:2E4BDA709A0C7BD214FC8CF6DCE31113
SHA256:9B9E9A89DFF9669D970D743B115085DD459FC776CE2C0135596DF95C26AC87FA
1280fix.exeC:\Users\admin\AppData\Roaming\scvhost.exeexecutable
MD5:2E4BDA709A0C7BD214FC8CF6DCE31113
SHA256:9B9E9A89DFF9669D970D743B115085DD459FC776CE2C0135596DF95C26AC87FA
1280fix.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.lnkbinary
MD5:60F6A66D6C0FB08EB77BAF5186212B66
SHA256:2517E4F44ABE90B2760C800D64195E54FF180FD36369B1CB387CFEEC88CFE7AD
1280fix.exeC:\Users\admin\AppData\Local\Temp\qmhijs.exeexecutable
MD5:AADD874DCF8CF0042FC25D0C45DD9C5F
SHA256:C7EF7E4580A5740D01C3AE5634D59B39A377C81812EFDF074AE412E2981E22C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
34
DNS requests
20
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.24.77.24:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.24.77.24:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7788
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
142.250.186.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
7788
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
142.250.186.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
184.24.77.24:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.24.77.24:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 184.24.77.24
  • 184.24.77.15
  • 184.24.77.28
  • 184.24.77.19
  • 184.24.77.31
  • 184.24.77.30
  • 184.24.77.26
  • 184.24.77.20
  • 184.24.77.29
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.129
  • 20.190.159.130
  • 40.126.31.1
  • 20.190.159.131
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
—
—
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
—
—
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
NixWare-Fix.zip