MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 7

Intelligence 7 IOCs YARA 4 File information Comments

SHA256 hash:	66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d
SHA3-384 hash:	2e294403ed8fa8020347b21c733058e4a7332f56bee387a68b788a5515bff8b4e0ccf284b65af0b633956f2c32978ce7
SHA1 hash:	bd3b1ce8d1df07e5f69a27688f7f3e07df1c8244
MD5 hash:	80e804d1361240f30e121dca2593acbd
humanhash:	speaker-pasta-diet-fruit
File name:	proceso.vbs
Download:	download sample
Signature	XWorm Create hunting rule
File size:	140'602 bytes
First seen:	2026-10-05 16:56:43 UTC
Last seen:	2026-10-05 16:56:43 UTC
File type:	vbs
MIME type:	text/plain
ssdeep	1536:AR4dRR88AEhG6+aKyF8VqiCGttj+EAqNLVcozGVHwrrhdKBq0rmXiu4oGhOoSi5j:6yCcNVlPoGmG
TLSH	T1FBD38DEA7C022DBC050B8675CC6A054F7FF8C933850964613E1E22A91F674B9E395FE9
Magika	vba
Reporter	BlinkzSec
Tags:	xworm

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90767/

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

base64 cscript lolbin schtasks wscript

Link:

https://www.filescan.io/uploads/6ac3e6a0aa8f8fc6388abaef/reports/62d1e8a6-ff14-401a-b8bd-c4753bf21ef9/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d

Verdict:

Malicious

File Type:

vbs

First seen:

2026-10-05T10:28:00Z UTC

Last seen:

2026-10-07T06:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d/results?tab=lookup

Score:

14%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d

Verdict:

Malware

YARA:

2 match(es)

Tags:

Base64 Block Contains Base64 Block DeObfuscated PowerShell T1027 T1059.001 T1105

Link:

https://app.malva.re/file/80e804d1361240f30e121dca2593acbd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m2twiif3uldixwbs6ivyv5hqcbq4dxs23mmcr7b57kgkwjg42soq._file

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm defense_evasion discovery execution persistence rat trojan

Link:

https://tria.ge/reports/261005-vgetkazzbx/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Enumerates video capture drivers

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Enumerates connected drives

Indicator Removal: File Deletion

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Detect Xworm Payload

Family: Xworm

Malware Config

C2 Extraction:

medellin202156.duckdns.org:7777

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_tiny_vbs Create hunting rule
Author:	daniyyell
Description:	Detects tiny VBS delivery technique

Rule name:	MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects AgentTesla (inconnu, etat extrait)

Rule name:	PowerShell_Susp_Parameter_Combo_RID336F Create hunting rule
Author:	Florian Roth
Description:	Detects PowerShell invocation with suspicious parameters
Reference:	https://goo.gl/uAic1X