MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1be153b2200554bd42cf7ac42337c4e88e5583e664ad2ec415af80219f133c0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1be153b2200554bd42cf7ac42337c4e88e5583e664ad2ec415af80219f133c0d
SHA3-384 hash:	41b7f8aa0872e17fe8a679e84c1ea229aa480f83335716ae339aa46898c9cd0e17b289382fe110d2efe6c4bc6ce6b56a
SHA1 hash:	ba405eed9b682d434033ab3f80282d761a0f58ae
MD5 hash:	14cf0727a2773a7e5e3aac84d3a144f5
humanhash:	sweet-asparagus-nitrogen-oranges
File name:	Factura MAT 27597.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	161'951 bytes
First seen:	2026-10-11 15:18:28 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	3072:hFtH45b9L9FzmDbhv+VA0D8TEE+n3AbEYm/:TCb9hFzo8VA0Yxu3AbNQ
TLSH	T13FF312747958CE49C227E78CE64F90891FF35FB1D5069E6313E9328B1EB712A9A90C34
Magika	javascript
Reporter	abuse_ch
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

174

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.18827191.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm encrypted evasive fingerprint lolbin masquerade msbuild obfuscated obfuscated repaired

Link:

https://www.filescan.io/uploads/6acba8f56cc0940bf51fa790/reports/01ae52de-086c-478a-82ae-cf0ab8cffc8b/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/1be153b2200554bd42cf7ac42337c4e88e5583e664ad2ec415af80219f133c0d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-10-09T14:16:00Z UTC

Last seen:

2026-10-12T14:06:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/1be153b2200554bd42cf7ac42337c4e88e5583e664ad2ec415af80219f133c0d/results?tab=lookup

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1985495

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected malicious Powershell script

Allocates memory in foreign processes

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Found malware configuration

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1be153b2200554bd42cf7ac42337c4e88e5583e664ad2ec415af80219f133c0d

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1be153b2200554bd42cf7ac42337c4e88e5583e664ad2ec415af80219f133c0d/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-09 18:39:36 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 36 (22.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dpqvhmraavkl2qwpplccgn6e5chfla7gmsws5ravv6acdhythqgq._file

Threatray XWorm

Verdict:

malicious

Label(s):

XWorm

Alert

Create hunting rule

Link:

https://reports.threatray.com/3ec5c3dd-84c1-4254-a7e8-a13c18f2e1cf

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm defense_evasion discovery execution rat trojan

Link:

https://tria.ge/reports/261011-sqbr6aa15v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Enumerates video capture drivers

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Detect Xworm Payload

Family: Xworm

Process spawned unexpected child process

Malware Config

C2 Extraction:

ogo1.duckdns.org:3567

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.