MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48abb729c4dd3419bbadd04d974a668d216d5513556d455bbd70dd3e2b723573. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	48abb729c4dd3419bbadd04d974a668d216d5513556d455bbd70dd3e2b723573
SHA3-384 hash:	98d9c7d7fa16ec98b1fef7a89ffd786ecf66e17a05975108dae44f5358eb6723a40eb25dbebd13b5eb66ab25dfe24b61
SHA1 hash:	580dd672d21f91ffb310a3507e2c7f4cf3037fb1
MD5 hash:	032c2cc1862303d06832c0ebe34b9dae
humanhash:	floor-rugby-connecticut-delaware
File name:	85673635.vbs
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	934 bytes
First seen:	2024-02-20 15:35:48 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	12:QIYeP916Aez7EhV0+FTCSElgpSKH6S69t/NgE1KQHiagcK8fIlQ:Qs1fE7w0OE6Yi6GEQK08fIlQ
Threatray	88 similar samples on MalwareBazaar
TLSH	T1EF11809253F95105F1F75B08983A26A81B33BE54583CC20C168C2E1D1FE3A04DC71BB7
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	abuse_ch
Tags:	vbs xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

128

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/477097/

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

nemucod virus

Link:

https://www.filescan.io/uploads/65d4c6eec5e1a083fbf3103c/reports/cf5bc442-8ef9-43c0-9f4d-958f81d438a1/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/48abb729c4dd3419bbadd04d974a668d216d5513556d455bbd70dd3e2b723573

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1395432

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Creates autostart registry keys with suspicious values (likely registry only malware)

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Sample uses string decryption to hide its real strings

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Snort IDS alert for network traffic

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Uses dynamic DNS services

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/48abb729c4dd3419bbadd04d974a668d216d5513556d455bbd70dd3e2b723573

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/48abb729c4dd3419bbadd04d974a668d216d5513556d455bbd70dd3e2b723573/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jcv3okoe3u2bto5n2bgzostgruqw2vitkvwukw55odot4k3sgvzq._file

Threatray malicious

Verdict:

malicious

Similar samples:

7b34e6746d3340b778eeeee6a248b30e177d18ab71b121740552782c0d5be5aa

XWorm

8918ac8706f6f82a2d1a567f00f92820d48cbecf6a2dc8c79282db4e6a8a762a

XWorm

b2116a9cf4d4ccc1d6af08c523e8e7766efd2f1d338f6f2a8235fa8ecd59dc4a

XWorm

d0dcf814c26f582ad69096d4ede801a1867076517587d16384c891a65bf17c4f

XWorm

db72ae0337d3edac28c3ad0acd80f5ef24a8f54afb98484217021d26359e224e

XWorm

+ 78 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm persistence rat trojan

Link:

https://tria.ge/reports/240220-s1xsdaaf91/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Drops startup file

Blocklisted process makes network request

Detect Xworm Payload

Xworm

Malware Config

C2 Extraction:

febxworm39090.duckdns.org:9090

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/48abb729c4dd3419bbadd04d974a668d216d5513556d455bbd70dd3e2b723573

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

vbs 48abb729c4dd3419bbadd04d974a668d216d5513556d455bbd70dd3e2b723573

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/477097/