MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93be4f52f2c44e85adf3f22f274d52ceb21c064f823f06007c09e8e652333ee6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93be4f52f2c44e85adf3f22f274d52ceb21c064f823f06007c09e8e652333ee6
SHA3-384 hash: 8c0729b2ddacc08e2ec169db28741a7743eaadb5bdb6e7033fc383c5d564ccdd14dbaf7573dcb60d0e5021838b14e806
SHA1 hash: fc7942f68657081d344edbf8486451bf7213959d
MD5 hash: 08fdd43ce1893f15d0aa7f4c8e865e28
humanhash: sodium-lake-helium-seven
File name:samples_specifications_drawings_request_quotation_08_19_2025.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:38'856 bytes
First seen:2025-08-19 10:36:21 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:Zjph1hf+Gee0dpSsIq2eBa1RtBbRlOQwrRUw2FGt7+h:Zjxee0dUsIKE1RllO/rCFGt7+h
Threatray 2'287 similar samples on MalwareBazaar
TLSH T1AC03087F7F4FE23A9C06418BFA762082BE3CC1A49E518054FE9C4B5E1455AC9C476EAC
Magika vba
Reporter lowmal3
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/22144/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a453c7c2f5296a1a284603
Tags:
ransomware obfuscate valyria xtreme
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/68a453c9a4bdac9f5b9e1668/reports/8678c83d-a6e2-451f-81a6-b6f3845a418d/overview
Verdict:
Malicious
Labled as:
Valyria
Link:
https://www.hybrid-analysis.com/sample/93be4f52f2c44e85adf3f22f274d52ceb21c064f823f06007c09e8e652333ee6
Result
Threat name:
PureLog Stealer, XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1760058
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Found malware configuration
Found Tor onion address
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected PureLog Stealer
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1760058 Sample: samples_specifications_draw... Startdate: 19/08/2025 Architecture: WINDOWS Score: 100 27 businesstradings.duckdns.org 2->27 29 ia600901.us.archive.org 2->29 31 3 other IPs or domains 2->31 49 Suricata IDS alerts for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 57 11 other signatures 2->57 8 wscript.exe 2->8         started        11 svchost.exe 1 1 2->11         started        signatures3 55 Uses dynamic DNS services 27->55 process4 dnsIp5 61 Suspicious powershell command line found 8->61 63 Wscript starts Powershell (via cmd or directly) 8->63 65 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->65 67 2 other signatures 8->67 15 powershell.exe 14 16 8->15         started        35 127.0.0.1 unknown unknown 11->35 25 C:\ProgramData\Microsoft25etwork\...\qmgr.jfm, COM 11->25 dropped file6 signatures7 process8 dnsIp9 37 ia600901.us.archive.org 207.241.227.61, 443, 49699 INTERNET-ARCHIVEUS United States 15->37 39 katyache.com 185.68.16.29, 443, 49709 UKRAINE-ASUA Ukraine 15->39 41 archive.org 207.241.224.2, 443, 49698 INTERNET-ARCHIVEUS United States 15->41 43 Found Tor onion address 15->43 45 Writes to foreign memory regions 15->45 47 Injects a PE file into a foreign processes 15->47 19 MSBuild.exe 2 15->19         started        23 conhost.exe 15->23         started        signatures10 process11 dnsIp12 33 businesstradings.duckdns.org 185.167.61.11, 3033, 49710 INETLTDTR Turkey 19->33 59 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->59 signatures13
Score:
38%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/93be4f52f2c44e85adf3f22f274d52ceb21c064f823f06007c09e8e652333ee6
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93be4f52f2c44e85adf3f22f274d52ceb21c064f823f06007c09e8e652333ee6/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/93be4f52f2c44e85adf3f22f274d52ceb21c064f823f06007c09e8e652333ee6
Threat name:
Win32.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2025-08-19 10:36:45 UTC
File Type:
Text (VBS)
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=so7e6uxsyrhillpt6ixsotksz2zbybspqi7qmad4bhuomurth3ta._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
10890cc1d5f37293195081785824961a003734edff0f9a4f5b05e6dde1b0a2bc
XWorm
39fcfca241c6391afc7ad77aa3f2c62b3e49d7e59a5aff0ae845ede5836c933f
XWorm
699b91f69cd0d059794175c55675ad931a2eaa18cb713523265429da6b021633
XWorm
b2d37a411be06457caf2304ba93bc85e447082acbbc8c82f6d171e7911045751
XWorm
cbfd2c9ea3cb57537837c0f440d55352d7fa622d29d57a41bc05a86372c58067
XWorm
error
XWorm
+ 2'277 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm defense_evasion discovery execution rat trojan
Link:
https://tria.ge/reports/250819-mnl78abj6v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Modifies trusted root certificate store through registry
Detect Xworm Payload
Process spawned unexpected child process
Xworm
Xworm family
Malware Config
C2 Extraction:
businesstradings.duckdns.org:3033
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93be4f52f2c44e85adf3f22f274d52ceb21c064f823f06007c09e8e652333ee6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Visual Basic Script (vbs) vbs 93be4f52f2c44e85adf3f22f274d52ceb21c064f823f06007c09e8e652333ee6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/22144/

Comments