MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df6eac509b37b2dfe3ced246b01167bf4c9d82a3ba0d20b3f3da90072dbd0d99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	df6eac509b37b2dfe3ced246b01167bf4c9d82a3ba0d20b3f3da90072dbd0d99
SHA3-384 hash:	b24d10fca33c7d7c91374b2d52e82411881d0be2c36fe3bc034da966089ad7184bf26b04d3c35d5693ba889462503e42
SHA1 hash:	fca17a0505e3fa11d0c6e23982bd1f171047194b
MD5 hash:	31b2022a0d51a85091eae57a4b504c4e
humanhash:	mirror-saturn-steak-robert
File name:	0.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	408'293 bytes
First seen:	2025-06-18 13:58:10 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:CLvTcobxKUCzY7VjJ4Vlp7UJFPzgLvTcobxKUCzY7VjJ4VlpX:odxKwja9dxKwjaX
TLSH	T12694500A6F1160B158F7A35ABE2A8204E5313317945286373DFED6446F72CC4D7BAEE8
Magika	javascript
Reporter	JAMESWT_WT
Tags:	191-96-79-137 js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

362

Origin country :

IT

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6852c6078469b16a4d2239f0

Tags:

obfuscate cryxos xtreme virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/6852c60b66c4b5c0b99a502f/reports/f008329c-df2a-4820-8f50-d261e37e323d/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/df6eac509b37b2dfe3ced246b01167bf4c9d82a3ba0d20b3f3da90072dbd0d99

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1717541

Signature

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found suspicious powershell code related to unpacking or dynamic code loading

Javascript file is likely language aware (will only work on specific systems)

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/df6eac509b37b2dfe3ced246b01167bf4c9d82a3ba0d20b3f3da90072dbd0d99

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/31b2022a0d51a85091eae57a4b504c4e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df6eac509b37b2dfe3ced246b01167bf4c9d82a3ba0d20b3f3da90072dbd0d99/

ReversingLabs TitaniumCloud Script-JS.Backdoor.FormBook

Threat name:

Script-JS.Backdoor.FormBook

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-18 08:55:49 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=35xkyue3g6zn7y6o2jdlaelhx5gj3avdxigsbm7t3kiaoln5bwmq._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution persistence rat trojan

Link:

https://tria.ge/reports/250618-q91vaaek21/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Drops startup file

Executes dropped EXE

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Detect Xworm Payload

Xworm

Xworm family

Malware Config

C2 Extraction:

191.96.79.137:7000

Dropper Extraction:

https://cdn.tagbox.io/assets/6850bda459dffb0011a76b02/a3edcbb7-06ae-4329-bf33-096c01a0636d---wp4096799-lost-in-space-wallpapers.jpg

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/df6eac509b37b2dfe3ced246b01167bf4c9d82a3ba0d20b3f3da90072dbd0d99