MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62e65ddf448f62409bf2b252a1dda1c300de21fb0fff06ab07903360f301c1b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62e65ddf448f62409bf2b252a1dda1c300de21fb0fff06ab07903360f301c1b5
SHA3-384 hash: 65884b17b6d8160c872141b01405667e95238c4d7192a390244c454f83b8589fe5127decd4c9b495cd22f5e6fc223b49
SHA1 hash: 8985a5d2d45b90d6216d7982cb8082af14b397fe
MD5 hash: 0532ea774b50c7c3e8be23c2b47844df
humanhash: violet-nebraska-happy-fanta
File name:sostener.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:247'540 bytes
First seen:2025-08-15 15:36:55 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 192:gSSSKSSSKSSSNpOz4thyYHXlSSSdSSSdSSSdSSSCXBSSSdSSSdSSSdSSSCXErSSM:ozc
Threatray 1'694 similar samples on MalwareBazaar
TLSH T11534151F5362832C19E14BBC132915FD8EDA738954473B4EC8A34A28AC485FE6FD9E53
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika mp3
Reporter abuse_ch
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
SE SE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21572/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689f54c68fd55a79c527409d
Tags:
obfuscate xtreme shell
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/689f5447a4bdac9f5b98a950/reports/fbcbfa6f-7f91-4626-bdbd-9cb96c45f6b8/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/62e65ddf448f62409bf2b252a1dda1c300de21fb0fff06ab07903360f301c1b5
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1757985
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Encrypted powershell cmdline option found
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1757985 Sample: sostener.vbs Startdate: 15/08/2025 Architecture: WINDOWS Score: 100 35 gotemburgoxm.duckdns.org 2->35 37 dpaste.org 2->37 39 bg.microsoft.map.fastly.net 2->39 53 Suricata IDS alerts for network traffic 2->53 55 Found malware configuration 2->55 57 Malicious sample detected (through community Yara rule) 2->57 61 14 other signatures 2->61 11 wscript.exe 1 2->11         started        14 svchost.exe 1 1 2->14         started        signatures3 59 Uses dynamic DNS services 35->59 process4 dnsIp5 67 VBScript performs obfuscated calls to suspicious functions 11->67 69 Suspicious powershell command line found 11->69 71 Wscript starts Powershell (via cmd or directly) 11->71 73 2 other signatures 11->73 17 powershell.exe 7 11->17         started        43 127.0.0.1 unknown unknown 14->43 signatures6 process7 signatures8 45 Suspicious powershell command line found 17->45 47 Encrypted powershell cmdline option found 17->47 49 Bypasses PowerShell execution policy 17->49 51 Found suspicious powershell code related to unpacking or dynamic code loading 17->51 20 powershell.exe 14 17 17->20         started        24 conhost.exe 17->24         started        process9 dnsIp10 41 dpaste.org 104.20.36.119, 443, 49681, 49682 CLOUDFLARENETUS United States 20->41 33 C:\Users\user\AppData\Local\Temp\veeoZ.ps1, Unicode 20->33 dropped 26 powershell.exe 11 20->26         started        file11 process12 signatures13 63 Writes to foreign memory regions 26->63 65 Injects a PE file into a foreign processes 26->65 29 MSBuild.exe 2 26->29         started        process14 process15 31 WerFault.exe 21 29->31         started       
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/62e65ddf448f62409bf2b252a1dda1c300de21fb0fff06ab07903360f301c1b5
Verdict:
Malware
YARA:
2 match(es)
Tags:
DeObfuscated PowerShell VBScript WScript.Shell
Link:
https://app.malva.re/file/0532ea774b50c7c3e8be23c2b47844df
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62e65ddf448f62409bf2b252a1dda1c300de21fb0fff06ab07903360f301c1b5/
Verdict:
Malicious
Threat:
Trojan.JS.Crypt
Link:
https://tip.neiki.dev/file/62e65ddf448f62409bf2b252a1dda1c300de21fb0fff06ab07903360f301c1b5
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-08-15 01:37:15 UTC
File Type:
Text (VBS)
AV detection:
4 of 38 (10.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mltf3x2er5rebg7swjjkdxnbyman4ip3b77qnkyhsazwb4ybyg2q._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
45b36ff2ce78b270727bfac3bc0caa839d6148e306adf709b0ff2eb9b8735226
XWorm
49de2c0ea488dd89b705c9ed19a78b5f27749a05ca652934df207a999007e1cb
XWorm
c5eb62901ad0fb2f14cafe7f6312e1436dd912d56671f6f1f2944da9d1fa599f
XWorm
ec145d51cb891b1e9a1e31088c0803371b5804baee1e766016b0a6f6e471f385
XWorm
error
XWorm
fed260507508e3c24632800ee2cd39e9c401cf6f84ebe3467979857cec2dfe9c
XWorm
+ 1'684 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm defense_evasion discovery execution rat trojan
Link:
https://tria.ge/reports/250815-s2vdmsylx8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Blocklisted process makes network request
Modifies trusted root certificate store through registry
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
gotemburgoxm.duckdns.org:49780
Dropper Extraction:
https://dpaste.org/NLPNG/raw
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62e65ddf448f62409bf2b252a1dda1c300de21fb0fff06ab07903360f301c1b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_VBS_Wscript_Shell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XWorm

Visual Basic Script (vbs) vbs 62e65ddf448f62409bf2b252a1dda1c300de21fb0fff06ab07903360f301c1b5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3509104/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3509106/
Cape
Cape
https://www.capesandbox.com/analysis/21572/

Comments