MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 471319aad8312f3f5da24f6366c3fd68698cfcd2b19db31d2209f14212760296. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 471319aad8312f3f5da24f6366c3fd68698cfcd2b19db31d2209f14212760296
SHA3-384 hash: ee977393d963926974a17c879b6823a1831c5bed5dc43c0dcc3fca3d1928275175abd9e341724747d44b50df1dd08aa9
SHA1 hash: 3bd85466c5c709e58149eec5e98d305db627573c
MD5 hash: bf6beb686461b112501e5b6a35a33218
humanhash: california-twenty-floor-item
File name:Zamówienie AMADA Sp. z o.o..vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:384'260 bytes
First seen:2025-04-17 11:28:47 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:wEQmUlDDxqqnk9H3cWC7v1baMCR1obcyCBREbUicPUyjT+HDlpHbaY:wblDQ9H3UJbaM+EJ5AiKiGY
Threatray 39 similar samples on MalwareBazaar
TLSH T1B684E6FAAE577678E94348C6C3E5B6160B1C483A5C1E1CF84CEF5136A0642BB7A4736C
Magika vba
Reporter abuse_ch
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/2691/
Detection(s):
SecuriteInfo.com.Script.SNH-gen.146.24689.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6800e9b6280f5f89a0d06ad2
Tags:
obfuscate xtreme shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive obfuscated overlay powershell
Link:
https://www.filescan.io/uploads/6800e61589fec6b88b9e82c5/reports/3f6016fb-a4e7-418e-b532-fedef2d87ff3/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/471319aad8312f3f5da24f6366c3fd68698cfcd2b19db31d2209f14212760296
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1667436
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Command shell drops VBS files
Connects to a pastebin service (likely for C&C)
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Yara detected UAC Bypass using CMSTP
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1667436 Sample: Zam#U00f3wienie AMADA Sp. z... Startdate: 17/04/2025 Architecture: WINDOWS Score: 100 43 jerrytech.duckdns.org 2->43 45 paste.ee 2->45 47 5 other IPs or domains 2->47 57 Suricata IDS alerts for network traffic 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 67 18 other signatures 2->67 9 wscript.exe 1 2->9         started        12 MSBuild.exe 2 2->12         started        14 MSBuild.exe 1 2->14         started        16 2 other processes 2->16 signatures3 63 Uses dynamic DNS services 43->63 65 Connects to a pastebin service (likely for C&C) 45->65 process4 signatures5 77 VBScript performs obfuscated calls to suspicious functions 9->77 79 Suspicious powershell command line found 9->79 81 Wscript starts Powershell (via cmd or directly) 9->81 83 2 other signatures 9->83 18 powershell.exe 15 16 9->18         started        22 conhost.exe 12->22         started        24 conhost.exe 14->24         started        process6 dnsIp7 49 ia801700.us.archive.org 207.241.233.30, 443, 49688 INTERNET-ARCHIVEUS United States 18->49 51 paste.ee 23.186.113.60, 443, 49689, 49690 KLAYER-GLOBALNL Reserved 18->51 53 archive.org 207.241.224.2, 443, 49687 INTERNET-ARCHIVEUS United States 18->53 69 Creates autostart registry keys with suspicious values (likely registry only malware) 18->69 71 Creates multiple autostart registry keys 18->71 73 Writes to foreign memory regions 18->73 75 Injects a PE file into a foreign processes 18->75 26 MSBuild.exe 1 4 18->26         started        31 cmd.exe 2 18->31         started        33 conhost.exe 18->33         started        35 MSBuild.exe 18->35         started        signatures8 process9 dnsIp10 55 jerrytech.duckdns.org 109.248.151.106, 49691, 8078 DATACLUBLV Russian Federation 26->55 39 C:\Users\user\AppData\Roaming\MSBuild.exe, PE32 26->39 dropped 85 Creates multiple autostart registry keys 26->85 41 C:\Users\Public\Downloads\unplacable.vbs, ASCII 31->41 dropped 87 Command shell drops VBS files 31->87 37 conhost.exe 31->37         started        file11 signatures12 process13
Score:
92%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/471319aad8312f3f5da24f6366c3fd68698cfcd2b19db31d2209f14212760296
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/471319aad8312f3f5da24f6366c3fd68698cfcd2b19db31d2209f14212760296/
Threat name:
Script-WScript.Backdoor.Xworm
Create hunting rule
Status:
Suspicious
First seen:
2025-04-17 11:29:34 UTC
File Type:
Binary
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i4jrtkwygext6xncj5rwnq75nbuyz7gswgo3ghjcbhyueetwakla._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
36e0589d6c7fe2ba454673e8ad1becbd09d60838d80f95ba4f7c4cbfa635816c
XWorm
3da71626391cd7e012a6a4075a4463e56af3eeb383ea990bd3b745235ce1ce3a
XWorm
5b9a611f5ca531f0794cf9601360e1414c72079689ce107c2ebf4c5bb6fc5f8d
XWorm
7c0946cd8a228f35db68a9bd702e283a3ab9f41113bede7ed206e9af5f824c9e
XWorm
923b51a8e59ac5dc4db026988ec3f205f21cbb6590cd14b0e68b9cb0d8114ad7
XWorm
9690ebb923acd798749d7bc2d1cee17d7c1899cf696558e440ecd2482907fddc
XWorm
a949f980d1d067a05f7f72bb34b83ac0a0c782607d8f79d27e78bed78327761f
XWorm
ad29a2fad9f4154afda4141b28b5dad16a72a4babd963ce73fc5bee151259b32
XWorm
b0f580611f79b3506b8ffcb745951d7de5811d3f91261d1fc08b247c32649688
XWorm
error
XWorm
fd3141f160c3e5782f6d2ce06b10f90af52dd438856295a925820ee0dfe23a96
XWorm
+ 29 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence rat trojan
Link:
https://tria.ge/reports/250417-nlq9tsxmx6/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Blocklisted process makes network request
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
jerrytech.duckdns.org:8078
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/2691/

Comments