🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4bcaa042fd2fdee097a8bfef573e94ce955144c8a52970383f5381b4821efbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4bcaa042fd2fdee097a8bfef573e94ce955144c8a52970383f5381b4821efbe
SHA3-384 hash: 30033e5395d8cbb7c535fad899d3c52512a2ca0f9b01c5a83efdd5c45dce136020201915c62896329ba788e81ba6d9e0
SHA1 hash: f7581a4d3449cbb90eb6aaafc98f6c8bd72f7a85
MD5 hash: 0d7f168c75444c86015a837e48d4f5c7
humanhash: blue-charlie-oscar-july
File name:Orden de compra_TECO09495_xls.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:35'605 bytes
First seen:2026-10-28 14:54:10 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:KcRQADlTbyhWk8SUOVU3iRiPAZdl7EUsTrx4J1FZMAq:LlvVkZUOVOPAl0xZAq
TLSH T1F3F2555EDC318BF03A2A6656A44B74199A2CC3676838FD0938FFD18C7B765108FC17A9
Magika vba
Reporter abuse_ch
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95757/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae20ca449621540087c29ee
Tags:
xtreme shell sage
Verdict:
Malicious
Labled as:
VBS/Agent.DAS
Link:
https://www.hybrid-analysis.com/sample/e4bcaa042fd2fdee097a8bfef573e94ce955144c8a52970383f5381b4821efbe
Verdict:
Malicious
File Type:
vbs
First seen:
2026-10-28T10:44:00Z UTC
Last seen:
2026-10-28T11:45:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/e4bcaa042fd2fdee097a8bfef573e94ce955144c8a52970383f5381b4821efbe/results?tab=lookup
Result
Threat name:
ResolverRAT, XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1994086
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to prevent local Windows debugging
Drops PE files with benign system names
Encrypted powershell cmdline option found
Excessive usage of taskkill to terminate processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected ResolverRAT
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1994086 Sample: Orden de compra_TECO09495_xls.vbs Startdate: 28/10/2026 Architecture: WINDOWS Score: 100 119 mr-b01.tm-azurefd.net 2->119 121 keyauth.win 2->121 123 5 other IPs or domains 2->123 129 Suricata IDS alerts for network traffic 2->129 131 Found malware configuration 2->131 133 Malicious sample detected (through community Yara rule) 2->133 135 15 other signatures 2->135 11 wscript.exe 1 2->11         started        14 wscript.exe 2->14         started        16 wscript.exe 2->16         started        18 6 other processes 2->18 signatures3 process4 signatures5 163 VBScript performs obfuscated calls to suspicious functions 11->163 165 Wscript starts Powershell (via cmd or directly) 11->165 167 Windows Scripting host queries suspicious COM object (likely to drop second stage) 11->167 169 Suspicious execution chain found 11->169 20 powershell.exe 11->20         started        171 WScript reads language and country specific registry keys (likely country aware script) 14->171 23 powershell.exe 14->23         started        25 powershell.exe 16->25         started        173 Contains functionality to prevent local Windows debugging 18->173 27 powershell.exe 18->27         started        29 powershell.exe 18->29         started        31 powershell.exe 18->31         started        33 powershell.exe 18->33         started        process6 signatures7 137 Suspicious powershell command line found 20->137 35 AppLaunch.exe 18 8 20->35         started        40 powershell.exe 10 20->40         started        44 3 other processes 20->44 46 5 other processes 23->46 48 5 other processes 25->48 50 3 other processes 27->50 52 2 other processes 29->52 54 2 other processes 31->54 42 conhost.exe 33->42         started        process8 dnsIp9 125 203.202.232.254, 1122, 49734, 49739 WHITELABELUS Turkey 35->125 127 187.52.45.38, 49735, 56932 VtalBR United States 35->127 97 C:\Users\user\AppData\...\XWormClient.exe, PE32 35->97 dropped 99 C:\Users\user\AppData\...\dtqkblnetchk.exe, PE32+ 35->99 dropped 139 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 35->139 141 Tries to harvest and steal browser information (history, passwords, etc) 35->141 143 Installs a global keyboard hook 35->143 145 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 35->145 56 dtqkblnetchk.exe 35->56         started        64 4 other processes 35->64 147 Found many strings related to Crypto-Wallets (likely being stolen) 40->147 66 3 other processes 40->66 101 C:\Users\user\AppData\Local\...\lbswlxvc.dll, PE32 44->101 dropped 103 C:\ProgramData\yu1.vbs, ASCII 44->103 dropped 68 2 other processes 44->68 105 C:\Users\user\AppData\Local\...\fbul1y4b.dll, PE32 46->105 dropped 70 4 other processes 46->70 107 C:\Users\user\AppData\Local\...\o4ykq5qe.dll, PE32 48->107 dropped 72 4 other processes 48->72 109 C:\Users\user\AppData\Local\...\hjhug4lc.dll, PE32 50->109 dropped 74 3 other processes 50->74 111 C:\Users\user\AppData\Local\...\kwkgsr33.dll, PE32 52->111 dropped 60 cvtres.exe 52->60         started        113 C:\Users\user\AppData\Local\...\hcnqp4a0.dll, PE32 54->113 dropped 62 cvtres.exe 54->62         started        file10 signatures11 process12 file13 115 C:\Users\user\AppData\Roaming\svchost.exe, PE32+ 56->115 dropped 149 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 56->149 151 Found many strings related to Crypto-Wallets (likely being stolen) 56->151 153 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 56->153 161 4 other signatures 56->161 76 powershell.exe 56->76         started        117 C:\Users\user\AppData\Local\...\AppLaunch.exe, PE32 64->117 dropped 155 Antivirus detection for dropped file 64->155 85 4 other processes 64->85 78 conhost.exe 66->78         started        87 3 other processes 66->87 81 conhost.exe 70->81         started        89 3 other processes 70->89 83 conhost.exe 72->83         started        91 3 other processes 72->91 157 Excessive usage of taskkill to terminate processes 74->157 159 Installs a global keyboard hook 74->159 93 3 other processes 74->93 signatures14 process15 signatures16 95 conhost.exe 76->95         started        175 Installs a global keyboard hook 78->175 process17
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e4bcaa042fd2fdee097a8bfef573e94ce955144c8a52970383f5381b4821efbe
Verdict:
Malware
YARA:
1 match(es)
Tags:
COM Behavior Trace DeObfuscated Obfuscated Scripting.Dictionary Scripting.FileSystemObject SOS: 0.64 T1027 T1059 T1059.005 VBScript WScript.Network WScript.Shell
Link:
https://app.malva.re/file/0d7f168c75444c86015a837e48d4f5c7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4bcaa042fd2fdee097a8bfef573e94ce955144c8a52970383f5381b4821efbe/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4s6kubbp2l664cl2rp7pk47jjtuvkfcmrjjjoa4d6u4bwsbb567a._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/44b4eb5b-0215-46ee-bc91-bc3d99b107cf
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm defense_evasion discovery execution persistence rat trojan
Link:
https://tria.ge/reports/261028-r91pyscz61/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Enumerates video capture drivers
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
203.202.232.254:1122
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e4bcaa042fd2fdee097a8bfef573e94ce955144c8a52970383f5381b4821efbe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:MULTI_Malware_GuLoader_ForgeAuto_2fbadefd
Create hunting rule
Author:Marjoriefort
Description:Detects GuLoader (inconnu, etat binaire)
Rule name:MULTI_Malware_MassLogger_ForgeAuto_885f4a8f
Create hunting rule
Author:Marjoriefort
Description:Detects MassLogger (inconnu, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/95757/

Comments