MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 644ba0805c354cc940caf1aa3ec0b62a1d9328fc214f84199ecb619093fcce1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 644ba0805c354cc940caf1aa3ec0b62a1d9328fc214f84199ecb619093fcce1f
SHA3-384 hash: d25ba60ba2a19f3ac3459be58b6bbb18602b3ec5e57ad5e5de03c50285bc5ce8e9b44069b93a44a3e8106b45e8b9d5ff
SHA1 hash: feb7b5a6689f667d3f6177db11ab1b87fd8939a8
MD5 hash: f6102e107ce1871b1cf37ade3f5462e0
humanhash: twenty-princess-oven-bravo
File name:PO21784.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:4'440'828 bytes
First seen:2023-04-01 07:25:58 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12288:mcWIjpvyMr/Rp2YGRchrMNLXFvvfwyQNJzsQ9xmhqJJrotcXeVB:R93/aCZM3AVDsC+CJ2cXqB
Threatray 39 similar samples on MalwareBazaar
TLSH T178266CF173DD47B2153FFDCA230B364CEE018013889AFD5A6795D8492A89E9FC59A630
Reporter abuse_ch
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/379212/
Detection(s):
SecuriteInfo.com.GT.VB.Honolulu.6.3416A851.29901.6830.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6427dc90c56b2da73aca460a/reports/83cc7c5e-ecf4-4ab4-a647-a8240736cc04/overview
Verdict:
Malicious
Labled as:
GT:VB.Honolulu.6
Link:
https://www.hybrid-analysis.com/sample/644ba0805c354cc940caf1aa3ec0b62a1d9328fc214f84199ecb619093fcce1f
Result
Verdict:
MALICIOUS
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1206289
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Drops VBS files to the startup folder
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Potential malicious VBS script found (suspicious strings)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Windows Shell Script Host drops VBS files
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected UnHook AMSI
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 839203 Sample: PO21784.vbs Startdate: 01/04/2023 Architecture: WINDOWS Score: 100 109 Malicious sample detected (through community Yara rule) 2->109 111 Antivirus detection for URL or domain 2->111 113 Sigma detected: Scheduled temp file as task from temp location 2->113 115 12 other signatures 2->115 10 wscript.exe 18 2->10         started        15 wscript.exe 1 2->15         started        17 wscript.exe 1 2->17         started        19 ouBYZutXDxhzI.exe 2->19         started        process3 dnsIp4 105 pastebin.pl 185.157.81.233, 443, 49701 S-NET-ASPL Poland 10->105 93 C:\Users\user\AppData\Roaming\...\VKLHV.ps1, ASCII 10->93 dropped 95 C:\Users\user\AppData\Roaming\...IMBC.cmd, ASCII 10->95 dropped 97 C:\Users\user\AppData\Roaming\...\MKGCI.vbs, ASCII 10->97 dropped 121 System process connects to network (likely due to code injection or exploit) 10->121 123 Wscript starts Powershell (via cmd or directly) 10->123 125 Potential malicious VBS script found (suspicious strings) 10->125 127 2 other signatures 10->127 21 cmd.exe 1 10->21         started        107 192.168.2.1 unknown unknown 15->107 24 cmd.exe 1 15->24         started        26 cmd.exe 17->26         started        28 conhost.exe 19->28         started        file5 signatures6 process7 signatures8 117 Wscript starts Powershell (via cmd or directly) 21->117 119 Bypasses PowerShell execution policy 21->119 30 powershell.exe 32 21->30         started        34 conhost.exe 21->34         started        36 powershell.exe 24->36         started        38 conhost.exe 24->38         started        40 powershell.exe 26->40         started        42 conhost.exe 26->42         started        process9 file10 99 C:\Users\user\AppData\...\hujtfq23.cmdline, Unicode 30->99 dropped 44 jsc.exe 4 30->44         started        47 CasPol.exe 2 30->47         started        49 MSBuild.exe 30->49         started        58 3 other processes 30->58 133 Writes to foreign memory regions 36->133 135 Injects a PE file into a foreign processes 36->135 51 jsc.exe 36->51         started        54 CasPol.exe 36->54         started        60 2 other processes 36->60 56 jsc.exe 40->56         started        62 2 other processes 40->62 signatures11 process12 file13 129 Uses schtasks.exe or at.exe to add and modify task schedules 44->129 64 WerFault.exe 44->64         started        66 dw20.exe 47->66         started        68 dw20.exe 49->68         started        87 C:\Users\user\AppData\Local\...\tmpCCA5.tmp, XML 51->87 dropped 89 C:\Users\user\AppData\...\ouBYZutXDxhzI.exe, PE32 51->89 dropped 131 Injects a PE file into a foreign processes 51->131 70 jsc.exe 51->70         started        73 schtasks.exe 51->73         started        75 dw20.exe 54->75         started        77 schtasks.exe 56->77         started        91 C:\Users\user\AppData\Local\...\hujtfq23.dll, PE32 58->91 dropped 79 dw20.exe 60->79         started        81 2 other processes 62->81 signatures14 process15 dnsIp16 101 212.193.30.230, 3363 SPD-NETTR Russian Federation 70->101 103 api.telegram.org 149.154.167.220, 443, 49720 TELEGRAMRU United Kingdom 70->103 83 conhost.exe 73->83         started        85 conhost.exe 77->85         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/644ba0805c354cc940caf1aa3ec0b62a1d9328fc214f84199ecb619093fcce1f/
Threat name:
Win32.Trojan.Honolulu
Create hunting rule
Status:
Malicious
First seen:
2023-04-01 07:26:10 UTC
File Type:
Text (VBS)
AV detection:
4 of 37 (10.81%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mrf2bac4gvgmsqgk6gvd5qfwfiozgkh4efhyigm6znqzbe74zypq._file
Verdict:
malicious
Similar samples:
189d5e75f300e21f30ae87cef1c384a3e33e26b5546b8404090bffe3251d4a34
XWorm
2e5243c0f25a508026aa4bc82e7cdddd2df91f556c8509ac6e2b60d3ef17b517
XWorm
3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7
XWorm
6869aea56b539fe8189237aeff9f338691b034ebbfce1688e0f05e080dc9fb7a
XWorm
763fc70c680ac478f31474306d6bb7a0f34893f98d691e0a49b6948a800cf7d4
XWorm
7c69c8b13870df342b88a74c4593de7cdafd313516a613e6d2c358654989b197
XWorm
87c1f33e1a2f359854fe99b0724a05efcfe41b143a3e7c5470dd3a7c63a508c1
XWorm
cab3e26e0ef44ba9322a03c14bc81a9f35a897c2da066eb6605d879a49ddc078
XWorm
f4b21e57bb6fabca1dd4b5499d5940749346c350975dcc07cf8f40db0376acfc
XWorm
+ 29 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm rat trojan
Link:
https://tria.ge/reports/230401-h9jxrsgf75/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks computer location settings
Blocklisted process makes network request
Xworm
Malware Config
C2 Extraction:
212.193.30.230:3363
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/644ba0805c35/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/644ba0805c354cc940caf1aa3ec0b62a1d9328fc214f84199ecb619093fcce1f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Visual Basic Script (vbs) vbs 644ba0805c354cc940caf1aa3ec0b62a1d9328fc214f84199ecb619093fcce1f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/379212/

Comments