MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3c54bcae35db1c091af07cb1fee2040430b26b1c7f2d28a3b176e211ba43ea02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 11
| SHA256 hash: | 3c54bcae35db1c091af07cb1fee2040430b26b1c7f2d28a3b176e211ba43ea02 |
|---|---|
| SHA3-384 hash: | a4bbd6075031d89d3269ea13ddc992cdded30c1f000167cb2f32e8a35a96889a4f25527943244a83da55f63eb614e0e6 |
| SHA1 hash: | 7bf9bc5986c7689aaba4b247a67524c5c05b80fa |
| MD5 hash: | 59269a5f9ec13878d9f060ff0d7ae647 |
| humanhash: | maine-eight-connecticut-charlie |
| File name: | runnerr.vbs |
| Download: | download sample |
| Signature | XWorm |
| File size: | 213 bytes |
| First seen: | 2026-06-26 18:14:28 UTC |
| Last seen: | Never |
| File type: |  vbs |
| MIME type: | text/plain |
| ssdeep | 6:j+K13NqcN7fBNLfdMGFlIPRFM1ERHSr1ERcWAf1wUs:KK1YcN1VfdMGWI1T1j19s |
| Threatray | 1'451 similar samples on MalwareBazaar |
| TLSH | T19FD022AA0025CD2B578BC1F48320129C89BBD3125EB0D87AC760CC0882849E26313EDA |
| Magika | vba |
| Reporter |  BastianHein |
| Tags: | vbs xworm |
Intelligence
File Origin
# of uploads :
1
# of downloads :
90
Origin country :
CLVendor Threat Intelligence
No detections
Detection:
n/a
Verdict:
Malicious
Score:
92.5%
Tags:
dropper shell sage
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
evasive explorer lolbin powershell taskkill timeout
Verdict:
Malicious
File Type:
vbs
First seen:
2026-05-07T14:03:00Z UTC
Last seen:
2026-06-27T20:09:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Script.Generic
Score:
31%
Verdict:
Susipicious
File Type:
SCRIPT
Verdict:
Malware
YARA:
1 match(es)
Tags:
Batch Command PowerShell PowerShell Call VBScript WScript.Shell
Verdict:
Malicious
Threat:
Trojan-Downloader.Script
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
xworm
Similar samples:
+ 1'441 additional samples on MalwareBazaar
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xmrig family:xworm defense_evasion discovery execution miner persistence rat trojan upx
Behaviour
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Launches sc.exe
Suspicious use of SetThreadContext
UPX packed file
Contacts third-party web service commonly abused for C2
Checks computer location settings
Creates new service(s)
Cryptocurrency Miner
Executes dropped EXE
Stops running service(s)
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
XMRig Miner payload
Detect Xworm Payload
Family: Xworm
Family: xmrig
Malware Config
C2 Extraction:
185.194.175.132:4445
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
File information
The table below shows additional information about this malware sample such as delivery method and external references.
bat 
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.