MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a802c9ee489aac5864b648bd3db2d1ec2db952001776582158df04d83b2d361. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a802c9ee489aac5864b648bd3db2d1ec2db952001776582158df04d83b2d361
SHA3-384 hash: a002412ee643aaf84d74f63c999c27bc012224e559ed5be7b76787f2170dd8daef9d2505bd51b360d7c818872ec19a14
SHA1 hash: c5446ff49ad07bfd01eefdf5689c128dbdd4c719
MD5 hash: 87d4d0bd1aa038999ef545434deb01ef
humanhash: robert-bluebird-eleven-oranges
File name:MV ATHENS GLORY - RFQ_SP-GLO-0320.xlsx.js
Download: download sample
Signature XWorm
Create hunting rule
File size:516'254 bytes
First seen:2026-08-20 07:58:12 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:mLYF5TRn5eVYmsGFrJchM0v6Kjl5p7/EKQ3oXKNB:t3jwrm7nQYc
TLSH T150B4853DE3AC4224D8D02120D3D1A3C1A13DAE8E9BDF521226AE68DFD3A5DD417539F6
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika txt
Reporter abuse_ch
Tags:js xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.JS.Obfus-799.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/8a802c9ee489aac5864b648bd3db2d1ec2db952001776582158df04d83b2d361
Result
Threat name:
Remcos, KeyLogger, XWorm
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1960992
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected malicious Powershell script
Antivirus detection for dropped file
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Detected Remcos RAT
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after checking mutex)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Installs a global keyboard hook
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites Mozilla Firefox settings
Potential evasive JS / VBS script found (domain check)
Powershell drops PE file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Cscript/Wscript Uncommon Script Extension Execution
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Sigma detected: Remcos
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1960992 Sample: MV ATHENS GLORY - RFQ_SP-GL... Startdate: 20/08/2026 Architecture: WINDOWS Score: 100 94 midle-eastcompany.com 2->94 96 sixmexicos.com 2->96 112 Suricata IDS alerts for network traffic 2->112 114 Found malware configuration 2->114 116 Malicious sample detected (through community Yara rule) 2->116 118 28 other signatures 2->118 10 oooxww.exe 2 3 2->10         started        14 powershell.exe 12 2->14         started        17 wscript.exe 1 7 2->17         started        19 12 other processes 2->19 signatures3 process4 dnsIp5 76 C:\ProgramData\Remcos\remcos.exe, PE32+ 10->76 dropped 164 Detected Remcos RAT 10->164 166 Creates autostart registry keys with suspicious names 10->166 168 Creates multiple autostart registry keys 10->168 21 remcos.exe 9 29 10->21         started        100 169.58.169.10, 49713, 7004 SOFTLAYER-IBMCloudUS Canada 14->100 78 C:\Users\user\AppData\Local\Temp\oooxww.exe, PE32+ 14->78 dropped 80 C:\Users\user\AppData\Local\Temp\llwbvj.exe, PE32 14->80 dropped 170 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->170 186 3 other signatures 14->186 26 llwbvj.exe 14->26         started        28 oooxww.exe 14->28         started        82 C:\Users\user\AppData\Local\...\1y6umt19ehk4b, ASCII 17->82 dropped 84 C:\Users\user\AppData\Local\...\1y6umt19ehk4a, ASCII 17->84 dropped 92 2 other malicious files 17->92 dropped 172 JScript performs obfuscated calls to suspicious functions 17->172 174 Suspicious powershell command line found 17->174 176 Wscript starts Powershell (via cmd or directly) 17->176 188 3 other signatures 17->188 102 sixmexicos.com 149.56.97.184, 443, 49711, 49712 OVHFR Canada 19->102 104 127.0.0.1 unknown unknown 19->104 86 C:\Users\user\AppData\Local\...\aw5mt19ejp3b, ASCII 19->86 dropped 88 C:\Users\user\AppData\Local\...\aw5mt19ejp3a, ASCII 19->88 dropped 90 C:\Users\user\AppData\...\aw5mt19ejp3.ps1, ASCII 19->90 dropped 178 Antivirus detection for dropped file 19->178 180 Contains functionality to bypass UAC (CMSTPLUA) 19->180 182 Found evasive API chain (may stop execution after checking mutex) 19->182 184 Unusual module load detection (module proxying) 19->184 30 conhost.exe 19->30         started        32 conhost.exe 19->32         started        34 conhost.exe 19->34         started        file6 signatures7 process8 dnsIp9 98 15.204.115.143, 2404, 49714, 49715 OVHFR United States 21->98 66 C:\Users\user\AppData\Local\...\startupr.exe, PE32+ 21->66 dropped 68 C:\Users\user\AppData\Local\Temp\THF823.tmp, PE32+ 21->68 dropped 70 C:\Users\user\AppData\Local\Temp\THBDB9.tmp, PE32+ 21->70 dropped 74 4 other malicious files 21->74 dropped 138 Antivirus detection for dropped file 21->138 140 Multi AV Scanner detection for dropped file 21->140 142 Detected Remcos RAT 21->142 156 8 other signatures 21->156 36 wscript.exe 21->36         started        40 startupr.exe 21->40         started        42 svchost.exe 21->42         started        46 2 other processes 21->46 72 C:\Users\user\AppData\...\XWormClient.exe, PE32 26->72 dropped 144 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 26->144 146 Creates multiple autostart registry keys 26->146 148 Overwrites Mozilla Firefox settings 26->148 150 Uses schtasks.exe or at.exe to add and modify task schedules 26->150 44 schtasks.exe 26->44         started        152 Contains functionality to bypass UAC (CMSTPLUA) 28->152 154 Installs a global keyboard hook 30->154 file10 signatures11 process12 file13 64 C:\Temp\ps_4jQKosolpQxo_1787214623506.ps1, ASCII 36->64 dropped 120 Suspicious powershell command line found 36->120 122 Wscript starts Powershell (via cmd or directly) 36->122 124 Creates autostart registry keys with suspicious values (likely registry only malware) 36->124 134 2 other signatures 36->134 48 powershell.exe 36->48         started        126 Antivirus detection for dropped file 40->126 128 Multi AV Scanner detection for dropped file 40->128 130 Detected unpacking (creates a PE file in dynamic memory) 40->130 136 2 other signatures 40->136 132 Detected Remcos RAT 42->132 51 conhost.exe 44->51         started        53 msedge.exe 46->53         started        signatures14 process15 signatures16 106 Writes to foreign memory regions 48->106 108 Injects a PE file into a foreign processes 48->108 55 aspnet_compiler.exe 48->55         started        58 conhost.exe 48->58         started        60 aspnet_compiler.exe 48->60         started        62 4 other processes 48->62 110 Installs a global keyboard hook 51->110 process17 signatures18 158 Detected Remcos RAT 55->158 160 Installs a global keyboard hook 55->160 162 Unusual module load detection (module proxying) 60->162
Score:
54%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/8a802c9ee489aac5864b648bd3db2d1ec2db952001776582158df04d83b2d361
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8a802c9ee489aac5864b648bd3db2d1ec2db952001776582158df04d83b2d361/
Threat name:
Script-JS.Backdoor.Xworm
Create hunting rule
Status:
Malicious
First seen:
2026-08-20 08:07:00 UTC
File Type:
Text (JavaScript)
AV detection:
11 of 38 (28.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rkaczhxergvmlbslmsf5hwznd3bnxfjaaf3wlaqvrxye3a5s2nqq._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:remcos family:xworm botnet:remotehost collection credential_access discovery execution persistence privilege_escalation rat spyware stealer trojan
Link:
https://tria.ge/reports/260820-jvr59sgn71/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Time Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Creates a file in the Startup directory
Executes dropped EXE
Reads user/profile data of web browsers
Adds policy Run key to start application
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Uses browser remote debugging
Detect Xworm Payload
Family: Remcos
Family: Xworm
Malware Config
C2 Extraction:
169.58.169.10:7004
15.204.115.143:7004
15.204.115.143:2404
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments