MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 170a64863ea4d4e5ffb1bfde801c315c1b12b3c34f4cb43872f63dbdb6da8285. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	170a64863ea4d4e5ffb1bfde801c315c1b12b3c34f4cb43872f63dbdb6da8285
SHA3-384 hash:	777e13c85b02b351b5aa84b79141afd620eba9935431db5c2f37ea9b8a8975aadc8fdcc59c7d1c32d8d6e9d9216c9889
SHA1 hash:	e9c29fd301734692e6f426464d98b6793e248be5
MD5 hash:	fcc68fe01caefe172e2348a77c462a30
humanhash:	glucose-thirteen-winner-kansas
File name:	screenshots.zip
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	3'613 bytes
First seen:	2024-02-08 15:54:12 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	48:9uN+eQCQLlzRXR/P9mRHYfxl+pFPyVqfKuSJtse3ZF:MNXQxNnqHYfj+pGqUpF
TLSH	T1F9713D38BFF59918C6A892B1918405AB5601047D0F1B517D0B4D35728CDD1B6E7EB14D
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	malwarology
Tags:	xworm zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

112

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	screenshots.vbs
File size:	2'848 bytes
SHA256 hash:	5d396ac219738c90a4d80fd423f91470994f2c13a49f7d20f0720e62a5734a0c
MD5 hash:	eefbf3700312a44c673c7724667f3566
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.UDF.VBS-1.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/170a64863ea4d4e5ffb1bfde801c315c1b12b3c34f4cb43872f63dbdb6da8285

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/170a64863ea4d4e5ffb1bfde801c315c1b12b3c34f4cb43872f63dbdb6da8285

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/170a64863ea4d4e5ffb1bfde801c315c1b12b3c34f4cb43872f63dbdb6da8285/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-02-07 20:25:38 UTC

File Type:

Binary (Archive)

Extracted files:

2

AV detection:

5 of 36 (13.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c4fgjbr6utkol75rx7piahbrlqnrfm6dj5gliods6y633nw2qkcq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/240208-txjl1sfh2v/

Behaviour

Script User-Agent

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/170a64863ea4d4e5ffb1bfde801c315c1b12b3c34f4cb43872f63dbdb6da8285

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

zip 170a64863ea4d4e5ffb1bfde801c315c1b12b3c34f4cb43872f63dbdb6da8285

(this sample)

XWorm

vbs 5d396ac219738c90a4d80fd423f91470994f2c13a49f7d20f0720e62a5734a0c

XWorm

img 79896ab9ec1fad79d24bf3d9cea0565d06f2b0f8119af8d1d7da98f167cd399a

any.run

https://app.any.run/tasks/d75d32b7-884b-4f30-a31d-29b46d54a7b8

  

Dropping

SHA256 79896ab9ec1fad79d24bf3d9cea0565d06f2b0f8119af8d1d7da98f167cd399a

  

Delivery method

Distributed via e-mail attachment

  

Dropping

MD5 4b361e8c05f68aff9c1a5371ea9c52ab