MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


N-W0rm


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559
SHA3-384 hash: fdc1a85b447adc670ddc65c6d73923348d8105502fd53c5f3df593a8201878c72f89e3a560906df6a57b33b7e2ab9eed
SHA1 hash: 8046a0f02d0673d3833b40bc5ac885b0a8891079
MD5 hash: 327fee2e572cf6b3b337fded32308189
humanhash: bakerloo-purple-illinois-ack
File name:ServerFAH.ps1
Download: download sample
Signature N-W0rm
Create hunting rule
File size:137'943 bytes
First seen:2022-02-22 18:23:56 UTC
Last seen:2022-02-22 18:56:23 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3072:xC3XSxzT6zNQety3ZUOB6JD0FSB9foD13ZE2QgppNVeM0suOgcTm/N+J/rr2UJrj:xC3XSxzT6zNQety3ZU8s0FScElK7LmF0
Threatray 1'242 similar samples on MalwareBazaar
TLSH T1CBD3BA21BD31B667AA85C25E345942EBF52913D3B390087533EBE3789148CA6F78F748
Reporter pr0xylife
Tags:N-W0rm nworm ps1

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.39050610.25656.17685.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62152a4a875593a3cc04ac7a/reports/94c808a6-ab46-431d-889b-f5e9bd1c2115/overview
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559/
Threat name:
Script-WScript.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2022-02-22 18:24:12 UTC
File Type:
Text (PowerShell)
AV detection:
10 of 27 (37.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gidaximmj3jj62sednqzhixgg5v3ipdve4evldyen2jwlnzhkvmq._file
Verdict:
unknown
Similar samples:
067e76900265c87d66a44f765bb720bd310e52181badf19efd63f30210f62001
N-W0rm
3a40d13ba6b30c31d8d5380b61806ec76355f4c10a3c242eff71ddc020907be7
N-W0rm
3d030fbfbe328bc4f276d565854f89189094ddb46dc1c6d36e8e9a438227279f
N-W0rm
81fe52e70e3f0562d02591313a49d2b353bedc557fcc09d3d6093160de68f3d0
N-W0rm
914cd602a58f69dd35dd207d8128807926a139f27f4d8b7b2b958041783bc10c
N-W0rm
92d30855da0de535afe7d2b432108880f5d3766767c09c493defcb6c05c10448
N-W0rm
cdf45f57fd8885bea02e2fcaf7b3a13c3f8185827cee1ef348a22cb36c1886c0
N-W0rm
dda839584708cdc28f165d0f387a43dbd32b7f56bba0af7c942ee2b751e9ab75
N-W0rm
eb24b3b9375f0b3272fac6eecc9329f79eab274d802b2ad37037cc83a46fa3f1
N-W0rm
f3b7556c1a960019ed0c01cdff84412b5c58beed377181573bb34a92f00ddb76
N-W0rm
+ 1'232 additional samples on MalwareBazaar
Result
Malware family:
nworm
Create hunting rule
Score:
  10/10
Tags:
family:nworm downloader worm
Link:
https://tria.ge/reports/220222-w12m4scbe8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Suspicious use of SetThreadContext
NWorm
Process spawned unexpected child process
Malware Config
C2 Extraction:
nyanmoj.duckdns.org:5057
moneyhope81.duckdns.org:5057
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/32060ba18c4e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:PowerShell_Susp_Parameter_Combo
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:PowerShell_Susp_Parameter_Combo_RID336F
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

N-W0rm

PowerShell (PS) ps1 32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2055383/
  
Delivery method
Distributed via web download

Comments