MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e8bd59fdd70b7f37c446835847d317ebfffa1309ffc10091d751e80c6a7eb8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e8bd59fdd70b7f37c446835847d317ebfffa1309ffc10091d751e80c6a7eb8f
SHA3-384 hash: 93dfd99535b13d5b887c7692ebb1429e16d085fb6d1e88ffa9bfef80013f4aa52e360f97a5326f40420c5b4534d23d6f
SHA1 hash: cab8a44a2c42a2ca8973136fc574ecf2d9033616
MD5 hash: be69d9e0c648e21b4fdf5be895566049
humanhash: fish-stairway-papa-whiskey
File name:Taiwan_PO-ORDER_SHEET_Request_Quotation_FEB_40FT_2025_pdf.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:1'183'366 bytes
First seen:2026-02-16 15:06:43 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:Tllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll4:jo
Threatray 46 similar samples on MalwareBazaar
TLSH T1F245004D6142F4AE9AC935F185278DF123C88BF4F1E81E3C7A40AB6BD586B594CBD930
Magika txt
Reporter James_inthe_box
Tags:exe vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53427/
Detection(s):
SecuriteInfo.com.VBS.Agent-101.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=699332a42715406c647a1d6e
Tags:
obfuscate xtreme keylog
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 base64 fingerprint masquerade obfuscated obfuscated overlay powershell
Link:
https://www.filescan.io/uploads/699332a22ffccda09770cc36/reports/d7515d97-f850-4fd6-98c5-cd94f28fc995/overview
Verdict:
Malicious
Labled as:
PSH/Agent.WL
Link:
https://www.hybrid-analysis.com/sample/6e8bd59fdd70b7f37c446835847d317ebfffa1309ffc10091d751e80c6a7eb8f
Verdict:
Malicious
File Type:
vbs
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/6e8bd59fdd70b7f37c446835847d317ebfffa1309ffc10091d751e80c6a7eb8f/results?tab=lookup
Score:
7%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/6e8bd59fdd70b7f37c446835847d317ebfffa1309ffc10091d751e80c6a7eb8f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e8bd59fdd70b7f37c446835847d317ebfffa1309ffc10091d751e80c6a7eb8f/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/6e8bd59fdd70b7f37c446835847d317ebfffa1309ffc10091d751e80c6a7eb8f
Threat name:
Script-WScript.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-02-16 12:54:48 UTC
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2f5lh65oc37g7cena2yi7jrp2777ijqt76baci5oupibrvh5ohq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
02bfa14c93bb09e666b102bde8dd2c6d5e7393ed34501d92954156e52ef3cc00
XWorm
16f331e6c7c5ec95bdd763d83516bb540e84aa165416a63861c9b3dd523a1905
XWorm
28411836a36d2e80c251de2fba0ac8c10258c9a4a8b69dab2977e26ef0d657e8
XWorm
51fdd83b3737add7f3832bd0ad0b56863c0a8f7cf9bcc16fd787d1ae4b403ce6
XWorm
c07cc41e7acf586cc74eb81b717be75d7881264e755815da2eee07d9294bcdbb
XWorm
c426915b181bc504a1baf2bc7e5d7103a29b81817595b654f92fe476b8058880
XWorm
e8fc8381979d1dae22218073d0afcf1b232a5d828cddf6463eea987760bb467d
XWorm
error
XWorm
fe7dd0edd4734a9c605c20d5963d95ebc33da9b3f908c9d62b0f68e125ee12d8
XWorm
+ 36 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm execution rat trojan
Link:
https://tria.ge/reports/260216-sheh3say2c/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Process spawned unexpected child process
Xworm
Xworm family
Malware Config
C2 Extraction:
xxblessings.minhaempresa.tv:1446
Dropper Extraction:
https://theipcommunity.com/optimized_MSI.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/6e8bd59fdd70b7f37c446835847d317ebfffa1309ffc10091d751e80c6a7eb8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/53427/

Comments