MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9
SHA3-384 hash: 86f193523e6c749d4e47366b8e2efc23bf72492b52f9fb71767e6c3a94d7bc255011a92014bbc1da710b46529782f80c
SHA1 hash: 81ec5cab8148bcef6849be21457808d1bafaa273
MD5 hash: fc1c6800c77edd0ba0bc6b195900630d
humanhash: march-purple-fish-neptune
File name:z1PaymentIssue07_20_26.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:1'143'344 bytes
First seen:2026-07-22 07:00:09 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/csv
ssdeep 192:KunDXukimSO7ATOmiCmoow9eeWOFE0q13cqmRVwTbM6+6RUMYTO2+h87jAkmk1eb:Z6371nImE0q1s7RG8Z6RU7zbD1fNK
TLSH T11F3594FF052AE7AAF132FF393CE9E8659E533002115BD0671A16B4BDAA5661270C05FC
Magika txt
Reporter FXOLabs
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75633/
Gathering data
Verdict:
Malicious
Labled as:
VBS/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9
Verdict:
Malicious
File Type:
text
First seen:
2026-07-22T02:09:00Z UTC
Last seen:
2026-07-23T04:45:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9/results?tab=lookup
Score:
24%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9
Verdict:
Malware
YARA:
1 match(es)
Tags:
Batch Command DeObfuscated PowerShell PowerShell Call Scripting.FileSystemObject T1027 T1059.001 T1059.005 VBScript Wscript.Shell
Link:
https://app.malva.re/file/fc1c6800c77edd0ba0bc6b195900630d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=husmovqgx6urxss746brgti3acrl7mw3ypnd6faejylsiupa5g4q._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/06166b2b-7487-4c36-afca-eda1eee679f8
Similar samples:
11006d4f7a6b1d1dd64f3fdaeb7a79a34373cdb2dc99755e7a9dfafc048d31a8
XWorm
18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612
XWorm
20360d508a5a447e74ef20c04f1df429178e5d395fe9021af34adf13299bfd66
XWorm
3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9
XWorm
5a979c309aff96456ba4482653fc213997387956c24e376645e4e0cfaa6b878a
XWorm
77fcdd4baf28b6e3ef7b47253576d14b36a119a801266b48171d7f7df54bd96e
XWorm
d99e59578c58923d0b56cfeb25bd14f60a7db8a47a8487bd22550035e39189e2
XWorm
f270d78e8a506da20b7da57be1777ea6f8ce5c7d5b54e05a91ffd1b19150cbdd
XWorm
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:siriusrat family:xworm collection discovery execution persistence rat trojan
Link:
https://tria.ge/reports/260722-h8ld7s1cpa/
Behaviour
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Executes dropped EXE
Badlisted process makes network request
Detect Xworm Payload
Detects SiriusRAT
Family: SiriusRAT
Family: Xworm
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Visual Basic Script (vbs) vbs 3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/75633/

Comments