MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612
SHA3-384 hash: 536ebb5fe2f94487938cebdd0db4dddae6c1aa09190499d1be328cf6bc2bac376745e4faa730f79dc0cf405a2e496260
SHA1 hash: 9f4cd7ce52dee3d751a019b84acb0c055ec87c5b
MD5 hash: d6a3dfc7aed72bbf5f310f98f3c37667
humanhash: skylark-lima-happy-whiskey
File name:PUR012908.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:836'734 bytes
First seen:2026-07-07 12:07:46 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/csv
ssdeep 192:kynrMKGYpaclNBLKTN+9qPRSIyDyi7erWpacN7NykSMFBAaprqfFDHNPvKGAuxL:FYpgSZoW
Threatray 80 similar samples on MalwareBazaar
TLSH T1BE0562995F256D7F2A1C1E0728B66C8814A63C943FB34D8F750E4D248606BE46EF34AF
Magika vba
Reporter abuse_ch
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73303/
Detection(s):
SecuriteInfo.com.VBS.Starter.539.1810.15239.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4c4b6432952f8351d0b454
Tags:
ransomware autorun shell sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
formbook obfuscated
Link:
https://www.filescan.io/uploads/6a4ced44a761171ecf83e699/reports/3ac02f18-7bb2-4417-94fa-08933841a2ec/overview
Verdict:
Malicious
Labled as:
Formbook
Link:
https://www.hybrid-analysis.com/sample/18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612
Verdict:
Malicious
File Type:
text
First seen:
2026-07-06T20:23:00Z UTC
Last seen:
2026-07-09T09:32:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Trojan.VBS.SAgent.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic
Link:
https://opentip.kaspersky.com/18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1938561
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains VNC / remote desktop functionality (version string found)
Creates processes via WMI
Detected large data written to user environment variables, potentially indicating payload staging for fileless execution
Drops VBS files to the startup folder
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Copy file to startup via Powershell
Sigma detected: Drops script at startup location
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1938561 Sample: PUR012908.vbs Startdate: 07/07/2026 Architecture: WINDOWS Score: 100 54 sunix-technology.com 2->54 56 keyauth.win 2->56 68 Suricata IDS alerts for network traffic 2->68 70 Found malware configuration 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 13 other signatures 2->74 9 powershell.exe 14 15 2->9         started        13 wscript.exe 1 1 2->13         started        15 wscript.exe 1 2->15         started        17 svchost.exe 1 1 2->17         started        signatures3 process4 dnsIp5 60 sunix-technology.com 192.232.216.135, 443, 49690, 49705 UNIFIEDLAYER-AS-1-UnifiedLayerUS United States 9->60 90 Writes to foreign memory regions 9->90 92 Injects a PE file into a foreign processes 9->92 19 CasPol.exe 3 5 9->19         started        23 CasPol.exe 9->23         started        25 conhost.exe 9->25         started        94 Suspicious powershell command line found 13->94 96 Wscript starts Powershell (via cmd or directly) 13->96 98 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->98 102 4 other signatures 13->102 27 powershell.exe 13 13->27         started        100 Contains VNC / remote desktop functionality (version string found) 15->100 30 powershell.exe 15->30         started        62 127.0.0.1 unknown unknown 17->62 signatures6 process7 dnsIp8 58 194.116.236.223, 1717, 49695 WHITELABELUS Turkey 19->58 76 Tries to harvest and steal browser information (history, passwords, etc) 19->76 78 Installs a global keyboard hook 19->78 32 CasPol.exe 19->32         started        35 csc.exe 4 19->35         started        80 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->80 82 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 23->82 50 C:\Users\...\PUR012908.vbs:Zone.Identifier, ASCII 27->50 dropped 52 C:\Users\user\AppData\...\PUR012908.vbs, CSV 27->52 dropped 84 Drops VBS files to the startup folder 27->84 38 conhost.exe 27->38         started        86 Writes to foreign memory regions 30->86 88 Injects a PE file into a foreign processes 30->88 40 conhost.exe 30->40         started        42 CasPol.exe 3 30->42         started        file9 signatures10 process11 file12 64 Antivirus detection for dropped file 32->64 48 C:\Users\user\AppData\Local\Temp\CasPol.exe, PE32 35->48 dropped 44 conhost.exe 35->44         started        46 cvtres.exe 1 35->46         started        66 Installs a global keyboard hook 38->66 signatures13 process14
Score:
72%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612/
Verdict:
Malicious
Threat:
Trojan.VBS.SAgent
Link:
https://tip.neiki.dev/file/18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-07-07 00:42:14 UTC
File Type:
Text (VBS)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ddssj6434yny5bai5lqutq2rewcmggc3zr6uxj33z5mr5x2lqyja._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
0661369bcc84ed31ddf3effe5165105748fa42b9d0bbfef276ed606a3093c417
XWorm
20360d508a5a447e74ef20c04f1df429178e5d395fe9021af34adf13299bfd66
XWorm
22620c9c6d0c2b392ee34bd4e7905b6f161bfe25ed3dc756302aeb091a994b0e
XWorm
67e7b0bf057c8c7ef117be16a168833235920d0af16921ff59d0866f0d05e050
XWorm
6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503
XWorm
882b0855a5b578a31bd03b6a47351d29ad9eb819d4c2c63408c3931a83254c7a
XWorm
9c0eb19d1579fbc93030d42465b90e092889b930733ffda60b5acb137a346dac
XWorm
ba8f9811ebb5944c39e09d2bd9351e0bf8ec305774e41edd5a49d9d3d3580ef9
XWorm
ecdaa31802b6a8ef94fbc3f16da5068c6f126876af0b9c964a915a556194a1f9
XWorm
error
XWorm
+ 70 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm collection discovery execution rat trojan
Link:
https://tria.ge/reports/260707-pdwd9aht6s/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Drops startup file
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Process spawned unexpected child process
Malware Config
C2 Extraction:
194.116.236.223:1717
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73303/

Comments