MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 769dc7f620ea7b504ee752d2b737aa5d98aa232b344c1547a287c5c1db73278a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 769dc7f620ea7b504ee752d2b737aa5d98aa232b344c1547a287c5c1db73278a
SHA3-384 hash: b23cd49dc49b77e060c08325b8bf9cce46db11199a3aab0798e1f591c47d2131b17ec76bd4750f5143aa012c01c0cbef
SHA1 hash: 9a83d8edc9af214f5b7ceca57a02822d4e1a2de5
MD5 hash: e3fad986d95869a865833df50ab608b9
humanhash: eight-hot-bacon-ceiling
File name:Adobe467200.js
Download: download sample
Signature XWorm
Create hunting rule
File size:47'367 bytes
First seen:2025-09-08 12:19:13 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 192:by8l/MRySFIU72OsTsVYoE3liSjlNBbxc:3c
Threatray 2'471 similar samples on MalwareBazaar
TLSH T140230061B57F51DB0CFA913B0A89BAD4E52C3B010F5C2FF1185A92FC80D8F5D982B966
Magika javascript
Reporter abuse_ch
Tags:js MSI-STEGO xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
SE SE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32320.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bec9e56e66ba602d792b70
Tags:
obfuscate xtreme shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm obfuscated powershell
Link:
https://www.filescan.io/uploads/68beca44e86455946923fd0a/reports/287439a1-d774-4ebc-b571-fc18d2768d0d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/769dc7f620ea7b504ee752d2b737aa5d98aa232b344c1547a287c5c1db73278a
Verdict:
Malicious
File Type:
js
First seen:
2025-09-05T15:48:00Z UTC
Last seen:
2025-09-05T15:48:00Z UTC
Hits:
~100
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic BSS:Trojan.Win32.Generic Backdoor.Agent.TCP.C&C
Link:
https://opentip.kaspersky.com/769dc7f620ea7b504ee752d2b737aa5d98aa232b344c1547a287c5c1db73278a/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1773106
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Found malware configuration
Found Tor onion address
Injects a PE file into a foreign processes
JavaScript source code contains functionality to generate code involving a shell, file or stream
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1773106 Sample: Adobe467200.js Startdate: 08/09/2025 Architecture: WINDOWS Score: 100 41 g100cf.ddns.net 2->41 43 dayzcheatcheck.online 2->43 45 3 other IPs or domains 2->45 57 Suricata IDS alerts for network traffic 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 65 18 other signatures 2->65 9 wscript.exe 1 2->9         started        12 powershell.exe 3 17 2->12         started        15 svchost.exe 1 1 2->15         started        signatures3 63 Uses dynamic DNS services 41->63 process4 dnsIp5 81 Suspicious powershell command line found 9->81 83 Wscript starts Powershell (via cmd or directly) 9->83 85 Windows Scripting host queries suspicious COM object (likely to drop second stage) 9->85 87 2 other signatures 9->87 18 powershell.exe 14 15 9->18         started        22 powershell.exe 15 15 9->22         started        24 conhost.exe 9->24         started        39 C:\Users\Public\Downloads\viK0E67an8.js, HTML 12->39 dropped 26 wscript.exe 12->26         started        28 conhost.exe 12->28         started        55 127.0.0.1 unknown unknown 15->55 file6 signatures7 process8 dnsIp9 47 comprovantes.eu 149.62.37.221, 443, 49685, 49686 DEDIPATH-LLCUS Germany 18->47 49 archive.org 207.241.224.2, 443, 49683 INTERNET-ARCHIVEUS United States 18->49 51 ia802909.us.archive.org 207.241.233.59, 443, 49684 INTERNET-ARCHIVEUS United States 18->51 67 Found Tor onion address 18->67 69 Writes to foreign memory regions 18->69 71 Suspicious execution chain found 18->71 73 Injects a PE file into a foreign processes 18->73 30 RegAsm.exe 2 18->30         started        34 conhost.exe 18->34         started        signatures10 process11 dnsIp12 53 g100cf.ddns.net 152.249.17.82, 49688, 7000 TELEFONICABRASILSABR Brazil 30->53 89 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 30->89 36 cmd.exe 1 30->36         started        signatures13 process14 signatures15 75 Suspicious powershell command line found 36->75 77 Wscript starts Powershell (via cmd or directly) 36->77 79 Creates processes via WMI 36->79
Score:
90%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/769dc7f620ea7b504ee752d2b737aa5d98aa232b344c1547a287c5c1db73278a
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/769dc7f620ea7b504ee752d2b737aa5d98aa232b344c1547a287c5c1db73278a/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/769dc7f620ea7b504ee752d2b737aa5d98aa232b344c1547a287c5c1db73278a
Threat name:
Script-JS.Backdoor.Xworm
Create hunting rule
Status:
Suspicious
First seen:
2025-09-06 09:25:25 UTC
File Type:
Binary
AV detection:
11 of 36 (30.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2o4p5ra5j5vatxhkljlon5klwmkuizlgrgbkr5cq7c4dw3te6fa._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
4fccf079d2e2942caad3338ada2aedf4290d380df931ae188e74693b86535da9
XWorm
5554ca93846129bc28fdcbfcd24d49ee67a117498bd6bcd99a498c0c48c41288
XWorm
8e3ac942df072256abcf91e4f1e5c76a09093374a9f5b997905dfc5a8b949e2a
XWorm
9219023b7da8a734c9d4063421680c5fd505adb36d2ba714118887df71ff4790
XWorm
9e81ab654b7791538849e8cdbc60b170c2e8de58bc38ba5248c0a6861ee3dae7
XWorm
a0c3fa62661159a9eef10b604214afade57a535a405c359b827a3bbd4b0cc63e
XWorm
d84b28f6ce7bca728fdf5eea7ed6cc3d6bed66d189c9218484d62fda4d5a4c9c
XWorm
dd526d6b1e6b225b484425cfce62bc318dae7ad5356e81587a511394a3e34aa0
XWorm
error
XWorm
f2444ec2549a9aad73567a3d1e1b00ff4de8be3727489c0cf1f5397975aa0c8d
XWorm
+ 2'461 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence rat trojan
Link:
https://tria.ge/reports/250908-pjg4tawwfs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Process spawned unexpected child process
Xworm
Xworm family
Malware Config
C2 Extraction:
g100cf.ddns.net:7000
Dropper Extraction:
https://archive.org/download/optimized_msi_20250904/optimized_MSI.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/769dc7f620ea7b504ee752d2b737aa5d98aa232b344c1547a287c5c1db73278a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments