🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1b8982db3c892a26a89f92339c48277cd0e0d9992a2b669eb4e28eaef098274. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1b8982db3c892a26a89f92339c48277cd0e0d9992a2b669eb4e28eaef098274
SHA3-384 hash: bc35d7ba7e817128541c9bea26ea071f03a91b5053bbeb31ccb504cf2dd897b43affa7f589d7c972eb07b6066a32098f
SHA1 hash: 962c6dd864971836752a0d3c2260fceb40b72ca6
MD5 hash: 326dd437e92b4bf1f847b7cebcca9a7d
humanhash: may-delaware-red-lemon
File name:AHK9876543234567890987234567890987_32.js
Download: download sample
Signature XWorm
Create hunting rule
File size:2'968'044 bytes
First seen:2026-10-16 16:47:06 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 49152:BIUQrm2ZvDX1pA2lYjHFcCVva3qi5OG3ks5BOymAHZk52AmDRKc/gzw7xGUZ+M+E:BIUQrm2ZvDX1a2lYjHFcCVy3qiIGUs5x
TLSH T14ED5849EC6A24F6E38DF1BCC3E53D9D1CB8FA724C0544ED3A1D6D6E2D6148C92682721
Magika txt
Reporter threatcat_ch
Tags:js xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
205
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Other.Malware-gen.34957263.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad255206f551121ba169f08
Tags:
autorun autoit emotet
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug autoit cmd dropper evasive expired-cert fingerprint keylogger lolbin obfuscated obfuscated packed persistence reconnaissance repaired schtasks wscript
Link:
https://www.filescan.io/uploads/6ad255274c6822ba937da24b/reports/c8be43d4-b7c2-4323-92ed-a6fa21bdfb0a/overview
Verdict:
Malicious
Labled as:
GT:JS.IcedId.1
Link:
https://www.hybrid-analysis.com/sample/c1b8982db3c892a26a89f92339c48277cd0e0d9992a2b669eb4e28eaef098274
Verdict:
Malicious
File Type:
js
First seen:
2026-10-16T11:07:00Z UTC
Last seen:
2026-10-18T11:02:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/c1b8982db3c892a26a89f92339c48277cd0e0d9992a2b669eb4e28eaef098274/results?tab=lookup
Result
Threat name:
DonutLoader, XWorm
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1988148
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected malicious Powershell script
Antivirus detection for dropped file
Benign windows process drops PE files
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Detected Windows Script Host debugger hammering
Encrypted powershell cmdline option found
Found malware configuration
JavaScript file contains suspicious strings
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected DonutLoader
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1988148 Sample: AHK987654323456789098723456... Startdate: 16/10/2026 Architecture: WINDOWS Score: 100 126 www.google.com 2->126 128 mobile-gtalk.l.google.com 2->128 130 2 other IPs or domains 2->130 136 Suricata IDS alerts for network traffic 2->136 138 Found malware configuration 2->138 140 Malicious sample detected (through community Yara rule) 2->140 142 16 other signatures 2->142 13 wscript.exe 2 12 2->13         started        17 wscript.exe 9 2->17         started        signatures3 process4 file5 96 C:\ProgramData\...\vcruntime140.dll, PE32 13->96 dropped 98 C:\ProgramData\...\YAUYGTZFVZZBMKMNH.exe, PE32 13->98 dropped 100 C:\ProgramData\...\YAUYGTZFVZZBMKMNH.zip, Zip 13->100 dropped 110 2 other malicious files 13->110 dropped 156 Benign windows process drops PE files 13->156 158 JScript performs obfuscated calls to suspicious functions 13->158 160 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->160 164 2 other signatures 13->164 19 YAUYGTZFVZZBMKMNH.exe 2 8 13->19         started        24 cmd.exe 1 13->24         started        102 C:\ProgramData\...\vcruntime140.dll, PE32 17->102 dropped 104 C:\ProgramData\...behaviorgraphVVSNGBUQKRQIPZYANGQ.exe, PE32 17->104 dropped 106 C:\ProgramData\...behaviorgraphVVSNGBUQKRQIPZYANGQ.zip, Zip 17->106 dropped 108 C:\ProgramData\...behaviorgraphVVSNGBUQKRQIPZYANGQ.ini, Unicode 17->108 dropped 162 WScript reads language and country specific registry keys (likely country aware script) 17->162 26 GVVSNGBUQKRQIPZYANGQ.exe 1 17->26         started        28 cmd.exe 17->28         started        signatures6 process7 dnsIp8 132 209.54.102.133, 4445, 49898 AS-COLOCROSSING-HostPapaUS United States 19->132 92 C:\Users\user\AppData\...\pohycbwz25l.exe, PE32+ 19->92 dropped 94 C:\Users\user\AppData\...\020brw43duq.ps1, ASCII 19->94 dropped 144 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->144 146 Encrypted powershell cmdline option found 19->146 148 Bypasses PowerShell execution policy 19->148 30 powershell.exe 19->30         started        34 YAUYGTZFVZZBMKMNH.exe 19->34         started        36 csc.exe 19->36         started        46 2 other processes 19->46 150 Uses schtasks.exe or at.exe to add and modify task schedules 24->150 38 conhost.exe 24->38         started        40 schtasks.exe 1 24->40         started        152 Unusual module load detection (module proxying) 26->152 42 conhost.exe 28->42         started        44 schtasks.exe 1 28->44         started        file9 signatures10 process11 file12 112 C:\Users\user\AppData\...\53dgsopq.cmdline, Unicode 30->112 dropped 166 Suspicious powershell command line found 30->166 48 powershell.exe 30->48         started        50 csc.exe 30->50         started        53 conhost.exe 30->53         started        168 Antivirus detection for dropped file 34->168 114 C:\Users\user\...\YAUYGTZFVZZBMKMNH.exe, PE32 36->114 dropped 55 conhost.exe 36->55         started        57 cvtres.exe 36->57         started        59 conhost.exe 46->59         started        61 cvtres.exe 46->61         started        signatures13 process14 file15 63 pohycbwz25l.exe 48->63         started        67 csc.exe 48->67         started        69 conhost.exe 48->69         started        90 C:\Users\user\AppData\Local\...\53dgsopq.dll, PE32 50->90 dropped 71 cvtres.exe 50->71         started        process16 file17 116 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 63->116 dropped 118 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 63->118 dropped 120 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 63->120 dropped 124 58 other malicious files 63->124 dropped 134 Multi AV Scanner detection for dropped file 63->134 73 pohycbwz25l.exe 63->73         started        122 C:\Users\user\AppData\Local\...\0smbmscr.dll, PE32 67->122 dropped 76 cvtres.exe 67->76         started        signatures18 process19 signatures20 154 Tries to harvest and steal browser information (history, passwords, etc) 73->154 78 taskkill.exe 73->78         started        80 taskkill.exe 73->80         started        82 taskkill.exe 73->82         started        process21 process22 84 conhost.exe 78->84         started        86 conhost.exe 80->86         started        88 conhost.exe 82->88         started       
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c1b8982db3c892a26a89f92339c48277cd0e0d9992a2b669eb4e28eaef098274
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1b8982db3c892a26a89f92339c48277cd0e0d9992a2b669eb4e28eaef098274/
Threat name:
Script-JS.Downloader.ModiLdr
Create hunting rule
Status:
Malicious
First seen:
2026-10-16 16:47:21 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 38 (26.32%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yg4jqlntzcjke2uj7erttreco7gq4dmzskrlm2pljyuov3yjqj2a._file
Verdict:
malicious
Label(s):
DonutLoader
Create hunting rule
XWorm
Create hunting rule
Link:
https://reports.threatray.com/9f584cf3-5ccf-42dd-8776-d805f5675315
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:xworm defense_evasion discovery execution loader persistence pyinstaller ransomware rat spyware stealer trojan upx
Link:
https://tria.ge/reports/261016-vang5ahv8j/
Behaviour
Kills process with taskkill
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Detects Pyinstaller
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Enumerates video capture drivers
UPX packed file
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Detect Xworm Payload
Detects DonutLoader
Family: DonutLoader
Family: Xworm
Malware Config
C2 Extraction:
209.54.102.133:4445
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1b8982db3c892a26a89f92339c48277cd0e0d9992a2b669eb4e28eaef098274

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XWorm

Java Script (JS) js c1b8982db3c892a26a89f92339c48277cd0e0d9992a2b669eb4e28eaef098274

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments