MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c3b6ec7c083b42ee8fc740390176c8946d4e1334eb6309f3b52119db1107948c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 13
| SHA256 hash: | c3b6ec7c083b42ee8fc740390176c8946d4e1334eb6309f3b52119db1107948c |
|---|---|
| SHA3-384 hash: | b421c4c52573c83b74ec64c2ab0c006dec6d55ac66ed979fadfdbd6a5f1d60da6588bbceead6b92a49b4a41b65051832 |
| SHA1 hash: | d9d1bc0756a34b7eca60bb9ec3f4f7aa50958b42 |
| MD5 hash: | f6c22772cbf9d609d7ea7ece081ae7fd |
| humanhash: | lion-bravo-lamp-hamper |
| File name: | z22output_1762289360.vbs |
| Download: | download sample |
| Signature | XWorm |
| File size: | 238'297 bytes |
| First seen: | 2025-11-05 01:01:14 UTC |
| Last seen: | 2025-11-05 15:24:42 UTC |
| File type: |  vbs |
| MIME type: | text/plain |
| ssdeep | 6144:AW69f/Ape/AOawp7J4/LAfYKtL4lWfFeobfBWSI4Ez/RM6VYvuH0COc:HeWSftY |
| Threatray | 1'454 similar samples on MalwareBazaar |
| TLSH | T167344A35F510AB7F1A13286271721F7B03EA394F5BA33A379586C5282E109245BEF1DB |
| Magika | vba |
| Reporter |  FXOLabs |
| Tags: | Spam-ITA vbs xworm |
Intelligence
File Origin
# of uploads :
10
# of downloads :
87
Origin country :
BRVendor Threat Intelligence
Detection:
XWorm
Verdict:
Malicious
Score:
92.5%
Tags:
obfuscate xtreme shell
Verdict:
Malicious
File Type:
vbs
First seen:
2025-11-04T19:42:00Z UTC
Last seen:
2025-11-06T23:24:00Z UTC
Hits:
~10000
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.VBS.SAgent.gen HEUR:Trojan.Script.Generic HEUR:Trojan.PowerShell.Tesre.sb Backdoor.Agent.TCP.C&C Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan-Downloader.Script.Generic
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Verdict:
Malware
YARA:
1 match(es)
Tags:
Scripting.FileSystemObject VBScript
Verdict:
Malicious
Threat:
Family.XWORM
Threat name:
Script-WScript.Trojan.Egairtigado
Status:
Malicious
First seen:
2025-11-05 00:49:31 UTC
File Type:
Text (VBS)
AV detection:
12 of 38 (31.58%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
xworm
Similar samples:
+ 1'444 additional samples on MalwareBazaar
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xworm execution rat trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Detect Xworm Payload
Process spawned unexpected child process
Xworm
Xworm family
Malware Config
C2 Extraction:
31.40.204.73:1414
Malware family:
XWorm
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.