MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066
SHA3-384 hash:	3c71b58ae1eaa4a364d30297983ee49a85c8298384ce3209597b30387be3a4607cb5c4f949766d9ab113e20e3b2f086e
SHA1 hash:	774cd24cdd4f048a2a8c8e922e7a4d38fd3189b0
MD5 hash:	634eb9320cb4f68904ae3b1a7f79e618
humanhash:	july-mobile-north-princess
File name:	shared.vbs
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	2'433'906 bytes
First seen:	2024-05-16 09:51:56 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	1536:yDirsVK3UWzV4AgpQqfmaB27EXtBSgb8N2nCDlez32htAYYjqNRv5Lv6cHRbIRdx:TSN3ek
TLSH	T10BB5D5597EA50C1B7276CA876A9C6579EC58C5FECF14102CE08092CE4ECFD57AB83E60
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	NDA0E
Tags:	vbs xworm

NDA0E

http://157.254.165.243:3001/www/shared.vbs

XWorm C2: dvaverif.ru:7000 (157.254.165.243:7000)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

103

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-95.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1442529

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Encrypted powershell cmdline option found

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Powershell drops PE file

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Zeus

Threat name:

Script-WScript.Trojan.Zeus

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-05-16 07:47:06 UTC

File Type:

Text (VBS)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jmcwc5xp6ohkmjreubweetvs74bbuylmrbbjlvfxsntmdxbkubta._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm execution rat trojan

Link:

https://tria.ge/reports/240516-lv22kseh5y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Detect Xworm Payload

Xworm

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066