MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 256504f53f32ebb1c73e9b833a24991a117ea5aa307c2597abcd1e6e6cbf2d69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 256504f53f32ebb1c73e9b833a24991a117ea5aa307c2597abcd1e6e6cbf2d69
SHA3-384 hash: 39b54f487ba40960ddd89134e8c3306cd6b27d4c8c325ae26289fd9519204b8140f3c23991e53955e07f09ebaa016913
SHA1 hash: 9fd0bc3240efd6bdb7479193e6148237f644efde
MD5 hash: 6ada6f14375931c884f9ce31349b23f7
humanhash: undress-london-north-maine
File name:Contract - CB-KLS a c2 (003) - 04.08.26.js
Download: download sample
Signature XWorm
Create hunting rule
File size:1'012'864 bytes
First seen:2026-08-04 09:03:18 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 96:ZVAEvA1hRTZ4gZdXptcAWEtEGFbMuMr2FvrqnqhIDWR6cet/KiBtxCbxj/K2ImMb:QX4g7/5t9nqnq9Zatowc0RA+
TLSH T1BC250D736AD61C4DBFF47329DC0662B49749B43E0EEE0649752CC19643A649FEE22C32
Magika javascript
Reporter abuse_ch
Tags:js xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Trojan-Downloader.JS.Agent.31547.28603.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm downloader fingerprint powershell repaired
Link:
https://www.filescan.io/uploads/6a71aaddfc2248607e2e867f/reports/df322330-7619-4cd5-a509-b270a19b94fe/overview
Verdict:
Malicious
Labled as:
JS/LausivLoader.H trojan
Link:
https://www.hybrid-analysis.com/sample/256504f53f32ebb1c73e9b833a24991a117ea5aa307c2597abcd1e6e6cbf2d69
Verdict:
Malicious
File Type:
js
First seen:
2026-08-04T05:17:00Z UTC
Last seen:
2026-08-05T07:06:00Z UTC
Hits:
~1000
Detections:
Trojan.VBS.SAgent.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/256504f53f32ebb1c73e9b833a24991a117ea5aa307c2597abcd1e6e6cbf2d69/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1951812
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Detected large data written to user environment variables, potentially indicating payload staging for fileless execution
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1951812 Sample: Contract - CB-KLS a c2 (003... Startdate: 04/08/2026 Architecture: WINDOWS Score: 100 48 savannahadventureslimited.com 2->48 50 sweet-snowflake-8a7e.uploadesclintesss.workers.dev 2->50 58 Suricata IDS alerts for network traffic 2->58 60 Found malware configuration 2->60 62 Malicious sample detected (through community Yara rule) 2->62 64 8 other signatures 2->64 10 wscript.exe 2 2->10         started        13 bin.exe 2 2->13         started        15 bin.exe 1 2->15         started        17 4 other processes 2->17 signatures3 process4 signatures5 78 Wscript starts Powershell (via cmd or directly) 10->78 80 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->80 82 Suspicious execution chain found 10->82 84 2 other signatures 10->84 19 powershell.exe 14 15 10->19         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started        27 conhost.exe 17->27         started        29 conhost.exe 17->29         started        31 conhost.exe 17->31         started        33 conhost.exe 17->33         started        process6 dnsIp7 52 savannahadventureslimited.com 51.79.17.60, 443, 49766 OVHFR Canada 19->52 54 sweet-snowflake-8a7e.uploadesclintesss.workers.dev 104.21.91.136, 443, 49765 CLOUDFLARENET-CloudflareIncUS Canada 19->54 66 Writes to foreign memory regions 19->66 68 Suspicious execution chain found 19->68 70 Injects a PE file into a foreign processes 19->70 72 Unusual module load detection (module proxying) 19->72 35 RegAsm.exe 1 5 19->35         started        40 conhost.exe 19->40         started        signatures8 process9 dnsIp10 56 109.248.150.234, 1012, 49767 DATACLUB-NLLV Netherlands 35->56 46 C:\Users\user\AppData\Roaming\bin.exe, PE32 35->46 dropped 74 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 35->74 76 Uses schtasks.exe or at.exe to add and modify task schedules 35->76 42 schtasks.exe 1 35->42         started        file11 signatures12 process13 process14 44 conhost.exe 42->44         started       
Score:
16%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/256504f53f32ebb1c73e9b833a24991a117ea5aa307c2597abcd1e6e6cbf2d69
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/256504f53f32ebb1c73e9b833a24991a117ea5aa307c2597abcd1e6e6cbf2d69/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=evsqj5j7glv3drz6tobtujezdiix5jnkgb6clf5lzupg43f7fvuq._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence privilege_escalation rat trojan
Link:
https://tria.ge/reports/260804-kz851swejf/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Creates a file in the Startup directory
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Process spawned unexpected child process
Malware Config
C2 Extraction:
109.248.150.234:1012
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/256504f53f32ebb1c73e9b833a24991a117ea5aa307c2597abcd1e6e6cbf2d69

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments