MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a60cadc9c823b64a80dd294c54e8c428f7ad12f846c245d3f3df1ba49cf3c62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a60cadc9c823b64a80dd294c54e8c428f7ad12f846c245d3f3df1ba49cf3c62
SHA3-384 hash: fc9e3e3275e1ce48570612cd862957ef3c3d3143653a6bc3f2aaa24379cea360bfa16d0b636d119e1f0da20cfe87959e
SHA1 hash: 526a9dffb93d30d2b5468e6459985a4897ad208e
MD5 hash: 3cf477d17f66f30eafd0198f38d29b29
humanhash: rugby-oranges-nevada-monkey
File name:Print1_7df514f78754974.pdf.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:1'225'256 bytes
First seen:2023-05-23 15:15:08 UTC
Last seen:2023-05-23 15:50:16 UTC
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12288:fghl+y9ix8yZk9CCKQQ1wRfSMMUsjTcktgZ8W6kiTqfTDnKei8o9UHNYr/Osn6lh:iI8yyZf/G3kiqng8cX2s6hy/6
Threatray 548 similar samples on MalwareBazaar
TLSH T1BD45F1328427BCEE275D2848904CDFB51C643B9786679A6E9A4CF1B332C92119F6DC7C
Reporter abuse_ch
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
2
# of downloads :
154
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26270.JsHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26271.JsHeur.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/646cd8b325edc3aec2f96c51/reports/7fbf5a64-8184-421c-be48-1856a7d99057/overview
Verdict:
Malicious
Labled as:
GT:VB.Dropper.2
Link:
https://www.hybrid-analysis.com/sample/8a60cadc9c823b64a80dd294c54e8c428f7ad12f846c245d3f3df1ba49cf3c62
Result
Verdict:
MALICIOUS
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1240964
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Deletes itself after installation
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Starts an encoded Visual Basic Script (VBE)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses dynamic DNS services
Uses ipconfig to lookup or modify the Windows network settings
VBScript performs obfuscated calls to suspicious functions
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 873975 Sample: Print1_7df514f78754974.pdf.vbs Startdate: 23/05/2023 Architecture: WINDOWS Score: 100 53 gunitp.duckdns.org 2->53 55 Snort IDS alert for network traffic 2->55 57 Found malware configuration 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 8 other signatures 2->61 10 wscript.exe 2 2->10         started        signatures3 process4 file5 45 C:\Users\user\svhost.exe, PE32 10->45 dropped 73 Benign windows process drops PE files 10->73 75 VBScript performs obfuscated calls to suspicious functions 10->75 77 Drops PE files to the user root directory 10->77 79 Deletes itself after installation 10->79 14 svhost.exe 2 79 10->14         started        18 attrib.exe 1 10->18         started        signatures6 process7 file8 47 C:\Users\user\AppData\...\belffcgccs.pif, PE32 14->47 dropped 81 Drops PE files with a suspicious file extension 14->81 83 Starts an encoded Visual Basic Script (VBE) 14->83 20 wscript.exe 1 14->20         started        22 conhost.exe 18->22         started        signatures9 process10 process11 24 belffcgccs.pif 1 3 20->24         started        28 cmd.exe 1 20->28         started        30 cmd.exe 1 20->30         started        file12 43 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 24->43 dropped 63 Multi AV Scanner detection for dropped file 24->63 65 Writes to foreign memory regions 24->65 67 Allocates memory in foreign processes 24->67 69 Injects a PE file into a foreign processes 24->69 32 RegSvcs.exe 1 2 24->32         started        71 Uses ipconfig to lookup or modify the Windows network settings 28->71 35 conhost.exe 28->35         started        37 ipconfig.exe 1 28->37         started        39 conhost.exe 30->39         started        41 ipconfig.exe 1 30->41         started        signatures13 process14 dnsIp15 49 gunitp.duckdns.org 94.130.138.74, 49702, 49703, 49704 HETZNER-ASDE Germany 32->49 51 192.168.2.1 unknown unknown 32->51
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a60cadc9c823b64a80dd294c54e8c428f7ad12f846c245d3f3df1ba49cf3c62/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-05-23 15:16:05 UTC
File Type:
Text (VBS)
AV detection:
3 of 37 (8.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rjqmvxe4qi5wjkan2kkmktumikhxvujpqrwcixj7hxy3usophrra._file
Verdict:
malicious
Similar samples:
234f7d8ed5bd6ab03e43324e3dee0406c727075e7334548d7e8bab8e18500660
XWorm
37203c38c11b529b8d10382dfb610e739ceb38daae8bc1c19f28506edf3dfdd1
XWorm
51ba2b6912305fd63c041dccff36db067314cab3f93227aaf21990801efa0b25
XWorm
592217d2590ae9ca688346688b2d7d13a78190f9562889597ebb79060136034c
XWorm
726bc1cc141d4ad30a0a1622d3aa8ac21af76273180b0efd160d2cc12d4a7fcb
XWorm
8e16304b756988b8fedf67c9c0eee38873fa743a2e9beae9bfc7bc44206e6a5d
XWorm
cbda14adc5ddc1c7dcaab3718dd25805b8c0b720db8678715a754754a214e05f
XWorm
d12374b77206c950e02f93c953e663d3f09a9708f9313ae0a74c636cae4851b8
XWorm
+ 538 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm persistence rat trojan
Link:
https://tria.ge/reports/230523-snfy4agg21/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Deletes itself
Executes dropped EXE
Loads dropped DLL
Xworm
Malware Config
C2 Extraction:
gunitp.duckdns.org:5050
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8a60cadc9c823b64a80dd294c54e8c428f7ad12f846c245d3f3df1ba49cf3c62

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Visual Basic Script (vbs) vbs 8a60cadc9c823b64a80dd294c54e8c428f7ad12f846c245d3f3df1ba49cf3c62

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments