MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09ff52a546c7517951367e6df955d8ea14a1089deb0cfd44f942537da8e8baac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	09ff52a546c7517951367e6df955d8ea14a1089deb0cfd44f942537da8e8baac
SHA3-384 hash:	50da4fba742c16385b49e4777f9d6489e7868397c7385c76dc9a545e400a779c17457c0190d3d20386d32a3b8eb48e50
SHA1 hash:	cb04255ba4cba6b6a1259fff289d10b90a9ac8b4
MD5 hash:	d997ded86ad5ad150c2370d278f14c8f
humanhash:	oscar-vegan-low-seventeen
File name:	sostener1.vbs
Download:	download sample
Signature	XWorm Create hunting rule
File size:	140'726 bytes
First seen:	2026-10-05 16:56:43 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	1536:6fjhr9CSa/ClCiEeQ3yoTM801y/mCDr+j2ZXvtfE/8vtYJ1Uuk7VpRT/pz87WJlY:6fqSa/Cl4yRmfEs3uk5Tujjuoue
TLSH	T1D9D37D8EFD1525B95A0751AA9CED444F7BF85033889864D0BE0D12D80F635FAA3E4FE8
Magika	vba
Reporter	BlinkzSec
Tags:	xworm

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90766/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6acf860bf4e17c78f7151c49

Tags:

dropper shell sage

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

base64 cscript lolbin schtasks wscript

Link:

https://www.filescan.io/uploads/6ac3e69cbe39f32105d96e0e/reports/eff81b5b-1cc9-4013-90b8-0dd4f7c825c9/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/09ff52a546c7517951367e6df955d8ea14a1089deb0cfd44f942537da8e8baac

Verdict:

Malicious

File Type:

vbs

First seen:

2026-10-05T13:40:00Z UTC

Last seen:

2026-10-07T04:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/09ff52a546c7517951367e6df955d8ea14a1089deb0cfd44f942537da8e8baac/results?tab=lookup

Score:

17%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/09ff52a546c7517951367e6df955d8ea14a1089deb0cfd44f942537da8e8baac

Verdict:

Malware

YARA:

2 match(es)

Tags:

Base64 Block Contains Base64 Block DeObfuscated PowerShell T1027 T1059.001 T1105

Link:

https://app.malva.re/file/d997ded86ad5ad150c2370d278f14c8f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/09ff52a546c7517951367e6df955d8ea14a1089deb0cfd44f942537da8e8baac/

Threat name:

Script-WScript.Trojan.XWorm

Status:

Malicious

First seen:

2026-10-05 14:44:16 UTC

File Type:

Text (Visual Basic)

AV detection:

7 of 38 (18.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bh7vfjkgy5ixsujwpzw7svoy5ikkcce55mgp2rhzijjx3khixkwa._file

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm defense_evasion discovery execution persistence rat trojan

Link:

https://tria.ge/reports/261005-vgehssab37/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Enumerates video capture drivers

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Enumerates connected drives

Indicator Removal: File Deletion

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Detect Xworm Payload

Family: Xworm

Malware Config

C2 Extraction:

medellin202156.duckdns.org:7777

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/09ff52a546c7517951367e6df955d8ea14a1089deb0cfd44f942537da8e8baac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_tiny_vbs Create hunting rule
Author:	daniyyell
Description:	Detects tiny VBS delivery technique

Rule name:	MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects AgentTesla (inconnu, etat extrait)

Rule name:	PowerShell_Susp_Parameter_Combo_RID336F Create hunting rule
Author:	Florian Roth
Description:	Detects PowerShell invocation with suspicious parameters
Reference:	https://goo.gl/uAic1X