MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 270c995cf90e01ccc91f573c18955cf7730d5a217135dd297c91d474e33f8558. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 270c995cf90e01ccc91f573c18955cf7730d5a217135dd297c91d474e33f8558
SHA3-384 hash: 0224eede22c8565f2ea8b6bcc16ec9e4c0a6e512f7d3f3729a7c83ce00993b3b33a5cbedf8c7112d1adea8a946e34a4b
SHA1 hash: 9c7145cb5e1efcaf8c67f34e27dee2bbc518d54d
MD5 hash: d4289e605bef1ea3f62eec4e11454044
humanhash: steak-nine-quebec-four
File name:513616103509452909612589303471676534521900095585.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:110'938 bytes
First seen:2024-04-16 15:39:04 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 3072:rQB02wBuU0W0tU1DHFUGmgURDFBe0tKl9CP4:J
TLSH T1D0B3AB526BFA1208F5F77B88A97611340B37BD99A97DC64C05CC290D0FF3A848865BB7
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter abuse_ch
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
89%
Tags:
certutil certutil cscript explorer lolbin
Link:
https://www.filescan.io/uploads/661e9bdb51edb67852f5f636/reports/a6c3d29b-a5a4-4ad7-9ccc-faf18ff6ec86/overview
Verdict:
Suspicious
Labled as:
VBS/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/270c995cf90e01ccc91f573c18955cf7730d5a217135dd297c91d474e33f8558
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1426874
Signature
Connects to a pastebin service (likely for C&C)
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Behaviour
Behavior Graph:
Download SVG
Score:
29%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/270c995cf90e01ccc91f573c18955cf7730d5a217135dd297c91d474e33f8558
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/270c995cf90e01ccc91f573c18955cf7730d5a217135dd297c91d474e33f8558/
Threat name:
Script-WScript.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-04-16 15:40:06 UTC
File Type:
Text (VBS)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e4gjsxhzbya4zsi7k46brfk465zq2wrboe252kl4shkhjyz7qvma._file
Verdict:
malicious
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm persistence rat trojan
Link:
https://tria.ge/reports/240416-s37eladg84/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Blocklisted process makes network request
Detect Xworm Payload
Xworm
Malware Config
C2 Extraction:
wormplace.duckdns.org:7771
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
XWorm
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/270c995cf90e01ccc91f573c18955cf7730d5a217135dd297c91d474e33f8558

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Certutil_Decode_OR_Download
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Certutil Decode
Reference:Internal Research
Rule name:SUSP_VBS_Wscript_Shell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments