MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d950928f9492e19a346689b43c077047d1ca80211714ab9adebd300f8bd1c11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d950928f9492e19a346689b43c077047d1ca80211714ab9adebd300f8bd1c11
SHA3-384 hash: 08a632e72637d65f0879bff25c35722c59e67f77d6bb87eae9ad2cc0ec8e6c085c06f20233fb505f21f6030a509336e7
SHA1 hash: 1412dfd46eeefdd255c879b1d68a3b5e53367028
MD5 hash: 9af39c7367e3bbfce7f72eaee5e976ab
humanhash: sad-undress-hamper-texas
File name:01 - 05 FEB 2026 KLRI 6128-ACE TRAVEL.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:1'161'100 bytes
First seen:2026-01-27 14:36:21 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:2DN3EaRrBxwjBe3ZB6skUgw3Pk8LEor3Eac+Qa3ZPe1/XSw3PKwz5OJvBe33Btch:axM5X8
Threatray 1'522 similar samples on MalwareBazaar
TLSH T1783512E53957F50A0EAA51E3DA20BC562BDB822345751CDC0CA4F75E88F9AEE4ED3C01
Magika unknown
Reporter James_inthe_box
Tags:exe vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/50393/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6978cd74bec9764f452f5c0f
Tags:
obfuscate xtreme virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 base64 fingerprint obfuscated obfuscated overlay powershell
Link:
https://www.filescan.io/uploads/6978cd6b4156786ccbda6ce4/reports/804492e3-b421-4f4c-a2db-ffc630947495/overview
Verdict:
Malicious
Labled as:
PSH/Agent.WL
Link:
https://www.hybrid-analysis.com/sample/8d950928f9492e19a346689b43c077047d1ca80211714ab9adebd300f8bd1c11
Verdict:
Malicious
File Type:
vbs
First seen:
2026-01-27T08:43:00Z UTC
Last seen:
2026-01-29T07:21:00Z UTC
Hits:
~1000
Detections:
UDS:DangerousObject.Multi.Generic Trojan.Win32.Zapchast.bhgd Trojan.JS.SAgent.sb HEUR:Trojan.Win32.Agentb.gen HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/8d950928f9492e19a346689b43c077047d1ca80211714ab9adebd300f8bd1c11/results?tab=lookup
Score:
20%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/8d950928f9492e19a346689b43c077047d1ca80211714ab9adebd300f8bd1c11
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d950928f9492e19a346689b43c077047d1ca80211714ab9adebd300f8bd1c11/
Verdict:
Malicious
Threat:
Trojan.Win32.Zapchast
Link:
https://tip.neiki.dev/file/8d950928f9492e19a346689b43c077047d1ca80211714ab9adebd300f8bd1c11
Threat name:
Script-WScript.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-01-27 11:57:20 UTC
File Type:
Binary
AV detection:
6 of 37 (16.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rwkqskhzjexbti2gncnuhqdxar6rzkaccfyuvonn5pjqb6f5dqiq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
1e09010334a0759862dc748e4dd2a78110603bdb6731495ead2c5d6fd64ba597
XWorm
2a5179a801fd80c213a1722f598fcf20e7e9b4b3a2cad768556fcdf4db110890
XWorm
3204af9817beaecaa95bb0b0d8b0e21232650503a4543009d6fb57a73afdc603
XWorm
5d04175f03512834d01a2c611cc9dde7b5cc42e952d5a491c5223a3117e85c2e
XWorm
65fdfb2fe35b497f7daf12505ca9ed686342b615b6d9b0b4b13af4ea390eb808
XWorm
731487a4cb9733ec62c3df861d44e39ddac523450f9b1d7523902b650c37ab9c
XWorm
cf518a1c6d447d1537802e21a32994e5fe3670e7521abe51bf20e96e3495bd22
XWorm
dac77365d906e8a22f2339a6940bc53862f5e30ab2a030f77149f846e32a47f6
XWorm
eb5c7c6370d533e6675ef2fb8b5f3f10cabc36584ddd3d3ad026af5266e84ed7
XWorm
error
XWorm
+ 1'512 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer family:xworm collection defense_evasion discovery execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/260127-ryt32abv2d/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
System Binary Proxy Execution: Regsvcs/Regasm
Detect Xworm Payload
Detects PhantomStealer payload
PhantomStealer
Phantom_stealer family
Process spawned unexpected child process
Xworm
Xworm family
Malware Config
C2 Extraction:
158.94.210.127:6991
Dropper Extraction:
https://res.cloudinary.com/dxxyxpqxg/image/upload/v1769187753/optimized_MSI_nthgyz.jpg
Malware family:
DnlibLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8d950928f949/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/8d950928f9492e19a346689b43c077047d1ca80211714ab9adebd300f8bd1c11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/50393/

Comments