MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452
SHA3-384 hash: 347e508f5eda5401ea733d9b68ec7cf9dfdef0d3d242c496204c3c89242c80efe3849aa4301efe356ef56690dbc982ea
SHA1 hash: f8419f0f5eafd3ae3f3cf4c5b136e4f6d7172052
MD5 hash: db5d4bd17a910eba855994fb7ba37737
humanhash: cola-one-sixteen-leopard
File name:Aviso de pago.js
Download: download sample
Signature XWorm
Create hunting rule
File size:245'916 bytes
First seen:2025-11-08 08:01:17 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:WEhpK47rs52VDunqjzaibs1fa9wUNlMgMITNOhpY6bTalR0VNjY96F1p6m:WEhZE5QDunCbf9pZMITNCY6belRaHqm
Threatray 78 similar samples on MalwareBazaar
TLSH T1833450EFF24404C32AF328766142A6CA20D9E53AFF1E1E3AF1B635A1DD547102759B9C
Magika javascript
Reporter abuse_ch
Tags:js xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690ef91330bacec888c9b742
Tags:
spawn shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 evasive fingerprint obfuscated powershell powershell repaired
Link:
https://www.filescan.io/uploads/690ef8fd2b74ec26eb6b7be5/reports/b60c61d5-03f8-4ff0-a59c-343a20729afb/overview
Verdict:
Malicious
Labled as:
BAT/TrojanDropper.Agent
Link:
https://www.hybrid-analysis.com/sample/3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452
Verdict:
Malicious
File Type:
js
First seen:
2025-11-07T02:17:00Z UTC
Last seen:
2025-11-10T06:15:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.BAT.Tesre.gen Trojan.JS.SAgent.sb Trojan.BAT.Agent.sb HEUR:Trojan.Script.Generic Trojan.PowerShell.AmsiBypass.sb PDM:Trojan.Win32.Generic HEUR:Trojan.PowerShell.Tesre.sb Backdoor.Agent.TCP.C&C Trojan-Downloader.JS.Cryptoload.sb Trojan.VBS.SAgent.sb
Link:
https://opentip.kaspersky.com/3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1810406
Signature
Bypasses PowerShell execution policy
Creates processes via WMI
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1810406 Sample: Aviso de pago.js Startdate: 08/11/2025 Architecture: WINDOWS Score: 100 33 Malicious sample detected (through community Yara rule) 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected Powershell decode and execute 2->37 39 6 other signatures 2->39 9 wscript.exe 1 1 2->9         started        process3 file4 29 C:\Users\user\AppData\Local\Tempbehaviorgraphreen.bat, ASCII 9->29 dropped 51 Wscript starts Powershell (via cmd or directly) 9->51 53 Windows Scripting host queries suspicious COM object (likely to drop second stage) 9->53 55 Suspicious execution chain found 9->55 57 Creates processes via WMI 9->57 13 cmd.exe 1 9->13         started        signatures5 process6 signatures7 59 Suspicious powershell command line found 13->59 61 Wscript starts Powershell (via cmd or directly) 13->61 63 Bypasses PowerShell execution policy 13->63 16 cmd.exe 1 13->16         started        18 conhost.exe 13->18         started        process8 process9 20 cmd.exe 2 16->20         started        signatures10 41 Suspicious powershell command line found 20->41 43 Wscript starts Powershell (via cmd or directly) 20->43 23 powershell.exe 1 28 20->23         started        27 conhost.exe 20->27         started        process11 dnsIp12 31 192.30.240.101, 1287, 49693 INTELLIGENT-TECHNOLOGY-SOLUTIONSUS United States 23->31 45 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->45 47 Found suspicious powershell code related to unpacking or dynamic code loading 23->47 49 Loading BitLocker PowerShell Module 23->49 signatures13
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2025-11-08 08:02:03 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hnlgf3fjfv4dojengwicvhzpgikppdaq7i4ih54mskqkzb234rja._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
1393a105128cb3b877843861a80b0c628c3b692e3473fa73ff818d1f47aaa7e6
XWorm
49adb2ba0f7b69d65978419b690af6ddca5d176cb143e24860decf5d41f4dedf
XWorm
4fc5db02f555a38fe3a0153e1f7d8261fc545a9ac7a2951a4558f5571b20531d
XWorm
60e6d178e020d6f0238910fdab18445d1a950c79d3c20b8560613364e14a6f0b
XWorm
84bc64c5f0b3e217896ebecb8b6d434d0c8fb4c33aa87125b3b8e2062aa283d5
XWorm
922d86e5f22d3bdc89f669e11158607f672391a5b3b557c4fac57d1581612d38
XWorm
b7e93b89a32f2b7ed23d4e053791bd79ca4a3ad0b864797eb575ced88da59f8e
XWorm
c3b6ec7c083b42ee8fc740390176c8946d4e1334eb6309f3b52119db1107948c
XWorm
d436b01ea1ce184f3e4e3e2ff3cfd4841f21e5008c6c827a2342c69711eae8c5
XWorm
error
XWorm
+ 68 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm execution rat trojan
Link:
https://tria.ge/reports/251108-jxazrsvkct/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Detect Xworm Payload
Process spawned unexpected child process
Xworm
Xworm family
Malware Config
C2 Extraction:
192.30.240.101:1287
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3b5662eca92d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments