MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c
SHA3-384 hash:	eb586ac83b389bb046e0d8b2bca17c68abad2a7108f84643d5ea5a8a930ef986be28bc4cdcaa573f83797ec8088856a8
SHA1 hash:	1b479af87739cd51fe9c68d286903dd77663139b
MD5 hash:	cb0504336b4a0750bac0e259cf57590d
humanhash:	november-spring-green-happy
File name:	cb0504336b4a0750bac0e259cf57590d.vbs
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	17'604 bytes
First seen:	2026-03-05 07:58:40 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:vjiwDII5Kh2fSsbR75GK29lz9pozyDmEqOGJf72ZSlcswmZ3dHYkjZ/xre6:vuwN5KNsbRYxylOGJfiShj3drK6
TLSH	T12E82763AF509EFF40B2E51E1018B6C06605447A6A53A4AFCB8CDC5587F26B508EE74EC
Magika	vba
Reporter	abuse_ch
Tags:	vbs xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/55636/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-150.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilVBA.LostAtSeaFuncInDirection.20240306.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a937e2002d37d5c983e37d

Tags:

obfuscate phishing xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 evasive guloader obfuscated obfuscated powershell

Link:

https://www.filescan.io/uploads/69a937e710e80629d4fcf524/reports/2937e51c-a565-49b9-bc5e-16deb9940c91/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

Detections:

HEUR:Trojan.Script.Generic PDM:Trojan.Win32.Generic Trojan-Downloader.PowerShell.NanoShield.sb Trojan.JS.SAgent.sb HEUR:Trojan-Downloader.Script.Generic

Link:

https://opentip.kaspersky.com/6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1878896

Signature

Antivirus detection for URL or domain

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell Decrypt And Execute Base64 Data

Sigma detected: Suspicious PowerShell IEX Execution Patterns

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected MSIL Injector

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

66%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c/

Neiki Family.XWORM

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c

ReversingLabs TitaniumCloud Win32.Trojan.Yomal

Threat name:

Win32.Trojan.Yomal

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-04 06:58:26 UTC

File Type:

Text (VBS)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nq6fzvnxn65sl5rzak6f2hgqgla5hnzgss466f2yh6wbgehu7goa._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution rat trojan

Link:

https://tria.ge/reports/260305-jvkq7aet7k/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

94.154.32.40:8383
:8383

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/55636/