MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cda178767af65f18a4cca8c662edf67f46a7acb018479cb5dc378194a3300148. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cda178767af65f18a4cca8c662edf67f46a7acb018479cb5dc378194a3300148
SHA3-384 hash:	2b741e058bfca179557cdcf55e4748ad9d0b439353518530ff601982b5f4437fbe157342f2fd4532131825839484c99a
SHA1 hash:	9fa94868ac9c79b43330f4ca6ec9cb21a3bd45a5
MD5 hash:	fc8dbb70d044eb44cd80c3fe60f724df
humanhash:	oven-ack-minnesota-ceiling
File name:	Products listed.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	3'059 bytes
First seen:	2025-05-12 11:50:54 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	48:BBU+Milh5O4LSEFF56Mkk56wFWzWWk1kFuf34/W6MkHOcmZcCM2Z3hqTOThVP/pS:BSuZVeBCMGwTYhVHp/na
Threatray	34 similar samples on MalwareBazaar
TLSH	T1C551FA81BE55A2AF4531258D646DE1C602C47233B2834E14E75C8B0DB262E5B72E67FF
Magika	javascript
Reporter	smica83
Tags:	209-54-102-133--8078 HUN js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

525

Origin country :

HU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.28640.15106.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6821e1b64a59e5a2ce03de7b

Tags:

obfuscate autorun xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/6821e0a90b64e174c422edb7/reports/ed095bf1-3200-4b9f-9137-2660381c588b/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Suspicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/cda178767af65f18a4cca8c662edf67f46a7acb018479cb5dc378194a3300148

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1687874

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Contains functionality to log keystrokes (.Net Source)

Creates autostart registry keys with suspicious values (likely registry only malware)

Creates multiple autostart registry keys

Found malware configuration

Found Tor onion address

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected UAC Bypass using CMSTP

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

5%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/cda178767af65f18a4cca8c662edf67f46a7acb018479cb5dc378194a3300148

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cda178767af65f18a4cca8c662edf67f46a7acb018479cb5dc378194a3300148/

ReversingLabs TitaniumCloud Script-JS.Trojan.Egairtigado

Threat name:

Script-JS.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-12 07:24:43 UTC

File Type:

Binary

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zwqxq5t26zprrjgmvddgf3pwp5dkplfqdbdzzno4g6azjizqafea._file

Threatray xworm

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

Similar samples:

1b2d6ba0dfcb2247cc3655f37844dbd378abd68364b454dad49288bcf977a88e

XWorm

3e65d73d24d876e7597dbda0fbcef9681dd7e16d241283ebf466eb0ad85c603b

XWorm

46bd635e26e21146d449e2032e7771614808a77c315c5d9478067ed9d6d6af2a

XWorm

5aa13f12284f388e4d78c6018ae782aa71da17c8cc737eb31dc3ee70c3caa2f5

XWorm

a091e95f8ef5a159d715f1f954bd84f9557b74ef94b2e2aaaef82907c159f1c0

XWorm

b2564c31effd83cb6893a5cf3e100a6fc7ca8f19e8671bceeae2b1604fc93c84

XWorm

cb859f68816f0ced3b81286af4c046aee24df83455e5bccef39d6d1f818cf95f

XWorm

d36ed137f9ad6964486285f443f21a27510c8b15f40ef2c47911b5a47b8bc083

XWorm

d4b5f80983a954f27ebecfdf87f26582b36b64c57f02ede40c74145d880a69f0

XWorm

error

XWorm

+ 24 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution persistence rat trojan

Link:

https://tria.ge/reports/250512-nz9ckasly9/

Behaviour

Modifies registry class

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Drops startup file

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

209.54.102.133:8078

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.28

Link:

https://yomi.yoroi.company/submissions/cda178767af65f18a4cca8c662edf67f46a7acb018479cb5dc378194a3300148