MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993
SHA3-384 hash:	303f44e424a61095618413738258f8eadd4193719d9268d71b815767c98eb8907ff21ee3641ceec40ed43b394c0b4145
SHA1 hash:	3271f06dd328c72918b6a94fa39077d206e76fa5
MD5 hash:	1db1dcbedd96d24445b5cde20aab3e96
humanhash:	potato-may-lion-hot
File name:	damaged_item.zip
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	2'988 bytes
First seen:	2024-02-16 18:03:38 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24:9pZUI8l1M8O/0VuesMJh7/iz8jaXWW8S6nXigg/HMjZGv95Vv/+VAdXpKXmAaa7x:9peI//sn/CizgPMuh/+VypK9R7ZOYsE
TLSH	T1EF51F753A74C1303D932E87C2BC99615342212AFA1D14E79AB2A51198F46639AD2E24E
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	malwarology
Tags:	xworm zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

131

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	damaged_item.vbs
File size:	560 bytes
SHA256 hash:	f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26
MD5 hash:	1d08ea9c2b5742989ddd848f545ddf00
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.UDF.VBS-1.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993/

ReversingLabs TitaniumCloud Binary.Trojan.Methuselah

Threat name:

Binary.Trojan.Methuselah

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-02-16 15:49:51 UTC

File Type:

Binary (Archive)

Extracted files:

2

AV detection:

3 of 38 (7.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o357zodvjot6epefljy5xa5k45oba3me4eddgc3xftz2fcsebgjq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

zip 76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993

(this sample)

XWorm

ps1 5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a

XWorm

ps1 7b34e6746d3340b778eeeee6a248b30e177d18ab71b121740552782c0d5be5aa

XWorm

vbs f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26

XWorm

img 40e61a6c5f46702a808cb94a2f27c6460b5a86c9878d831213c3acd31eee1984

any.run

https://app.any.run/tasks/5a9c1aaf-7658-4aa1-aa93-78b780ef5005

  

Dropping

SHA256 40e61a6c5f46702a808cb94a2f27c6460b5a86c9878d831213c3acd31eee1984

  

Delivery method

Distributed via e-mail attachment

  

Dropping

MD5 945c48b426452f9da691c46f2fdc6a07