MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7b0ebe32dce203d9163b122128f84dd05d1ddad4b8685b021bc0e6d9e326249. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7b0ebe32dce203d9163b122128f84dd05d1ddad4b8685b021bc0e6d9e326249
SHA3-384 hash: 0ab3f4c5f4a6dbce82e6a4fe2e7b3d345b9164f368d859b3e3fcc98376e43b141d5c821634f451ad901cb4c3904058d0
SHA1 hash: a77e0b10e951e4de49766291aaa7f2eb206a6eb0
MD5 hash: 02d686b00fedc9fbc4f63b11c5e3afdf
humanhash: washington-orange-helium-lima
File name:EIPASKCM146.html
Download: download sample
Signature XWorm
Create hunting rule
File size:1'854'316 bytes
First seen:2022-11-21 21:07:42 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 768:iDwAAALmLLLcl9b9b9ma9PmNSfxuI52kp999999999999999999999999999999N:iDwAAALmLLLclRRcCmNSgI52kJAAA57m
TLSH T113850EF5852CE8CBD34CE9C0C2202C96DEC61A0747624D38EEE3A87D786169DDE6D58D
Reporter k3dg3___
Tags:html xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilHTML.ISOTinyDancer.20221121.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/637be8b2bf871f68ac7db3c8/reports/b78bcca9-3d60-49eb-9ae4-6559e1ec246b/overview
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1118498
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b7b0ebe32dce203d9163b122128f84dd05d1ddad4b8685b021bc0e6d9e326249/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w6yoxyznzyqd3eldwerbfd4e3uc5dxnnjodilmbbxqhg3hrsmjeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.44
Link:
https://yomi.yoroi.company/submissions/b7b0ebe32dce203d9163b122128f84dd05d1ddad4b8685b021bc0e6d9e326249

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

html b7b0ebe32dce203d9163b122128f84dd05d1ddad4b8685b021bc0e6d9e326249

(this sample)

XWorm

Executable exe 001f3aa0aaf47c8757634c6c39b75a8423761e2503e0de19d93065cc8e7187f9

  
Link
https://tria.ge/221121-y3rl2aad4y
  
Dropping
SHA256 001f3aa0aaf47c8757634c6c39b75a8423761e2503e0de19d93065cc8e7187f9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
MD5 1d977c6853d0e9ff808671186fd986d0

Comments