MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 927a9f72eb0fb2e6e4189884e319ce4bbb99152c2b1c7670f3b5429be437714c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	927a9f72eb0fb2e6e4189884e319ce4bbb99152c2b1c7670f3b5429be437714c
SHA3-384 hash:	e149ea21a0d6a1acdc3ed53b32d65e6a3040a69367a1ef6f56096056751f991176f6a10749230927aeffb4075c5ef2b2
SHA1 hash:	ae19586b4df19348ecdbe68e491b22d0090e3043
MD5 hash:	8fd375e346650dcec40822075e426ffa
humanhash:	quebec-november-colorado-kilo
File name:	z20bl_confirm_a.vbs
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	105'108 bytes
First seen:	2025-05-14 02:00:07 UTC
Last seen:	2025-05-14 05:59:33 UTC
File type:	vbs
MIME type:	text/plain
ssdeep	1536:bouDzBshrkbmEKFfM9xb2rXkF5yA1qWT6PnDaqFdGk2GVkZOVoi+L8CAs8kOZpOn:EqnX2rXkvLdiDaqdRY0iL0fOsEzvWO
Threatray	1'766 similar samples on MalwareBazaar
TLSH	T1A4A3A539C7A4CDDDC32B70D27A1C7A4222195BEBEE551FBDA0864CFA09A104E57FE409
Magika	vba
Reporter	FXOLabs
Tags:	vbs xworm

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

160

Origin country :

BR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.BAT.Obfus-3.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6823f9f14a59e5a2ce045f43

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 evasive obfuscated powershell

Link:

https://www.filescan.io/uploads/6823f92c8bd61140fb6f1cf9/reports/a1ba665b-1a63-415d-8cf4-c4357bbbc8b1/overview

Hybrid Analysis TrojanDropper/VBS.Agent

Verdict:

Suspicious

Labled as:

TrojanDropper/VBS.Agent

Link:

https://www.hybrid-analysis.com/sample/927a9f72eb0fb2e6e4189884e319ce4bbb99152c2b1c7670f3b5429be437714c

Joe Sandbox Batch Injector, XWorm

Result

Threat name:

Batch Injector, XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1689526

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses dynamic DNS services

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Batch Injector

Yara detected Powershell decode and execute

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/927a9f72eb0fb2e6e4189884e319ce4bbb99152c2b1c7670f3b5429be437714c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/927a9f72eb0fb2e6e4189884e319ce4bbb99152c2b1c7670f3b5429be437714c/

ReversingLabs TitaniumCloud Script-WScript.Backdoor.Xworm

Threat name:

Script-WScript.Backdoor.Xworm

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-05-14 01:01:44 UTC

File Type:

Text (VBS)

AV detection:

11 of 37 (29.73%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sj5j64xlb6zonzaytccoggoojo5zsfjmfmohm4htwvbjxzbxofga._file

Threatray xworm

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

Similar samples:

53a2f686422f9f71b69d3a9699661c96dc1375d490ea188d5141bb1e8ae89029

XWorm

665e41e416954d5ff623a37c7bce17d409c11e003c29ae9ddeb25fc736e533c7

XWorm

67a85b53d785054676f0db7f79fea437f7a87e1eeb4938c6efed2fc55a061359

XWorm

80a21952b87d83eb419768268b334364ecab48dbb9cbe55b967ba9636e512cab

XWorm

95bd50b1c849b16159f239b176e9c48d97bc7d841441829ec974997a93cb4c1e

XWorm

d08c0197f69f9b77a3396a6f07c4432ed0bc3e5e0e450aed5f14f1aa42eda53e

XWorm

d0ef84c36715bc834f68415f2b16ca2e8088141a83231f27c4a7d6285d4b6d1a

XWorm

error

XWorm

fbb6e25ede47737ad9d540192a46117ce42c6e24c7ce60d027e36ff49cba8213

XWorm

+ 1'756 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm execution rat trojan

Link:

https://tria.ge/reports/250514-cfkpbacn5w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Blocklisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

botangroup.duckdns.org:3911

VMRay XWorm

Malware family:

XWorm

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/927a9f72eb0f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/927a9f72eb0fb2e6e4189884e319ce4bbb99152c2b1c7670f3b5429be437714c