MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6
SHA3-384 hash:	8665c5a1b0658df47fc2a51b66367b867f3266a43c8ac6428f6378a0c6a4ee09b0ea69acbeaf6b93b312581cbe076d9d
SHA1 hash:	1b0ad2671cafc0a263510f68fcab16be65767937
MD5 hash:	3a4fa8c063e5574917aa58cd0769cf2d
humanhash:	high-eleven-artist-maine
File name:	PURCHASE_ORDER#5001.vbs
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	121'064 bytes
First seen:	2025-11-10 12:10:47 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	3072:fzT5fkqQ4JuJcXAJxYwPz/OgFP5RJ8jg/i82r44PJDdb35fsHNjCeNUlxymUn:rT5MqQ4JuJcXAJxlL/OgF5Rz/i8s44PM
Threatray	1'555 similar samples on MalwareBazaar
TLSH	T177C34C7E16144C3ADCD62AB37A350C48287B7D8693602A77D937E4996F2231CE3F91E4
Magika	vba
Reporter	JAMESWT_WT
Tags:	31-40-204-73 api-telegram-org--bot8024716497 Spam-ITA vbs xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

92

Origin country :

IT

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/36696/

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6911d66ee2c9ded75d7901c2

Tags:

ransomware shell virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 cmd evasive fingerprint lolbin masquerade obfuscated obfuscated powershell

Link:

https://www.filescan.io/uploads/6911d66e935d9f0d73c9b616/reports/57c417aa-4af9-4608-ae93-30d4e8d9793d/overview

Hybrid Analysis VBS/TrojanDropper.Agent

Verdict:

Suspicious

Labled as:

VBS/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2025-11-10T07:30:00Z UTC

Last seen:

2025-11-12T09:59:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan.PowerShell.Tesre.sb Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan-Downloader.Script.Generic Trojan.JS.SAgent.sb HEUR:Trojan.VBS.SAgent.gen HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated Obfuscated Scripting.FileSystemObject T1059.005 VBScript

Link:

https://app.malva.re/file/3a4fa8c063e5574917aa58cd0769cf2d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6/

Neiki Family.XWORM

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6

ReversingLabs TitaniumCloud Script-WScript.Backdoor.Xworm

Threat name:

Script-WScript.Backdoor.Xworm

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-11-10 11:35:26 UTC

File Type:

Text

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ckghhycixbaobnacqx6xzf4yqcxty5g7i5e6xvze4j3xuajzstta._file

Threatray xworm

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

Similar samples:

383af49b39cab5da29cff6c729ee08eddf62380553315266fd0e3b1dfc0e552c

XWorm

66bfeec31ae784a09287c77924136fdf4308b3bf34757fadae49420961b7ca35

XWorm

702ccf23fea0beab32c3bb77868353d58c9e395eef8c9ba685c83d04e312b5eb

XWorm

818ff53dc566fff967d109ce7db973ff002170d89876a76022529d8a5b21ac0c

XWorm

922d86e5f22d3bdc89f669e11158607f672391a5b3b557c4fac57d1581612d38

XWorm

9c9cf095c3ff1c23a4938f8f815055521383bc6ec5e27d4647f0f6037f500402

XWorm

9fbdb7c445322d877ad9584cd6e346c958bfd676f2001b1d35a5793e647fdd33

XWorm

c3b6ec7c083b42ee8fc740390176c8946d4e1334eb6309f3b52119db1107948c

XWorm

error

XWorm

+ 1'545 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm execution rat trojan

Link:

https://tria.ge/reports/251110-pcsxqsfr4y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Legitimate hosting services abused for malware hosting/C2

Badlisted process makes network request

Detect Xworm Payload

Process spawned unexpected child process

Xworm

Xworm family

Malware Config

C2 Extraction:

31.40.204.73:1414

VMRay XWorm

Malware family:

XWorm

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/128c73e048b8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

XWorm

vbs 128c73e048b840e0b40285fd7c979880af3c74df4749ebd724e2777a013994e6

(this sample)

XWorm

bat 8950267b5c8b4ac7833a5fbb48100fa3ad837a0ea7483bd86b4a7b11cc2d8996

Cape

https://www.capesandbox.com/analysis/36696/

  

Dropping

SHA256 8950267b5c8b4ac7833a5fbb48100fa3ad837a0ea7483bd86b4a7b11cc2d8996

  

Dropping

MD5 22ab19c0f3797d8f691e2aed33f633b2