MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2d70be205dde4cf9a31bb4bd4ed08fe1f76dfa7c2681ca65d77dd5172ff7dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a2d70be205dde4cf9a31bb4bd4ed08fe1f76dfa7c2681ca65d77dd5172ff7dd8
SHA3-384 hash:	bf3f96ec42abce97e9fbcaf70f2938f803ce2d3c49b8e9a438b51189644d0382105321fd88759dab73f9fedcf2b7bb73
SHA1 hash:	5f2276eedffb87d0672d0bcba95127a5f44617ac
MD5 hash:	b372eabcf50c10fa43922dc9c68e3d0a
humanhash:	kansas-mountain-alabama-missouri
File name:	scott.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	1'392'667 bytes
First seen:	2025-03-26 13:09:09 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:8XnXnXnXnXnXnXnXnXnXnsXnXnXnXnXnXnXnXnXnXnsXnXnXnXnXnXnXnXnXnXn8:Fr
Threatray	159 similar samples on MalwareBazaar
TLSH	T1A0558C5A43670D7BF9C7AA9D253D5C211CDD1ED46AE733BCEB3A01603E08469E62B630
Magika	javascript
Reporter	abuse_ch
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

490

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e3fca2cb6d38a89f3e5b65

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive obfuscated obfuscated opendir opendir powershell

Link:

https://www.filescan.io/uploads/67e3fc8f09c39f5498b5a498/reports/8cf9b357-9d39-422c-b755-e605d381303f/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Suspicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/a2d70be205dde4cf9a31bb4bd4ed08fe1f76dfa7c2681ca65d77dd5172ff7dd8

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox KeyLogger, StormKitty, SugarDump, XWorm

Result

Threat name:

KeyLogger, StormKitty, SugarDump, XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1649117

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected Keylogger Generic

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected StormKitty Stealer

Yara detected SugarDump

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a2d70be205dde4cf9a31bb4bd4ed08fe1f76dfa7c2681ca65d77dd5172ff7dd8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a2d70be205dde4cf9a31bb4bd4ed08fe1f76dfa7c2681ca65d77dd5172ff7dd8/

ReversingLabs TitaniumCloud Script-JS.Trojan.Xworm

Threat name:

Script-JS.Trojan.Xworm

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-03-26 12:48:46 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ullqxyqf3xsm7grrxnf5j3ii7ypxnx5hyjubzjs5o7ovc4x7pxma._file

Threatray stormkitty xworm

Verdict:

malicious

Label(s):

stormkitty

Alert

Create hunting rule

xworm

Alert

Create hunting rule

Similar samples:

196b3a5cb409ba285267fba44efa46d8557f36cc33efd6a206eca5683417f5fa

XWorm

4e98af0f32aa268fa9ab8b1b1ee0acb26e16f4675369bc832ea1f79c2756d440

XWorm

55303d0457e7c41acc899e1c188e954e7d074ece5d93e071f4e861e355810953

XWorm

61d6d15b22aed7572cca9b5785f07f02eec562a4142c2fb8605dabc89d7710b5

XWorm

7f2d295bca7cb02c5263a780c6d6d334c0c83b926b295cb89dcdcc26b27c6906

XWorm

8797ff678c33470cda3880c22d76e970a2881fadbfc6d488ecb33d39b6197a03

XWorm

e6f6efe59057b773f8f7cd40f6bf80abffbfbbd44f3056e8da56f586fead4e8b

XWorm

error

XWorm

fa32f6938ecdcecd6a81c8fefddeb1e25fa8335db2911db0e5d16bc949f12970

XWorm

+ 149 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:stormkitty family:xworm discovery execution rat stealer trojan

Link:

https://tria.ge/reports/250326-qel3msv1ds/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Blocklisted process makes network request

Detect Xworm Payload

StormKitty

StormKitty payload

Stormkitty family

Xworm

Xworm family

Malware Config

C2 Extraction:

scotwire.ddns.net:1111

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a2d70be205dde4cf9a31bb4bd4ed08fe1f76dfa7c2681ca65d77dd5172ff7dd8