🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e87cd984112c6b57fdb8a9203572da62fd27960e59cfea51cf35a959624c404a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e87cd984112c6b57fdb8a9203572da62fd27960e59cfea51cf35a959624c404a
SHA3-384 hash: a26dc8abffa3c54bc8821b19ce8ce0ef79d4e06404137aa376587e166b1f38a07b9bed11e0103b1fda5454bc701c588a
SHA1 hash: ee0e897deffc135667dd9f78915404c9cb901e1e
MD5 hash: 2e9dd5681ac91c8f1bfb15aa2addfa41
humanhash: six-diet-kansas-cup
File name:Orden de compra_03893894.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:407'148 bytes
First seen:2026-10-07 18:00:01 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12288:pSQLpk9OG4xClz8fRBIQbqocknh1djMEi60fH:/kN0ClYJl1hXjMg0f
TLSH T13884F1D561EF64801CA042BFD7C0FDEA4A43FAF0B24C87A48212ECE301EAF5996955D7
Magika vba
Reporter abuse_ch
Tags:vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91018/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated powershell
Link:
https://www.filescan.io/uploads/6ac688c92db7b0ff5b5c834d/reports/b161b11b-37ed-49ea-af66-b69ed3e4317b/overview
Verdict:
Suspicious
Labled as:
JS/Obfuscated.CT trojan
Link:
https://www.hybrid-analysis.com/sample/e87cd984112c6b57fdb8a9203572da62fd27960e59cfea51cf35a959624c404a
Verdict:
Malicious
File Type:
vbs
First seen:
2026-10-07T09:30:00Z UTC
Last seen:
2026-10-07T14:50:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/e87cd984112c6b57fdb8a9203572da62fd27960e59cfea51cf35a959624c404a/results?tab=lookup
Result
Threat name:
SugarDump, XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1983775
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation Via Stdin
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell launch wmic via class
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Unusual module load detection (module proxying)
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected SugarDump
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1983775 Sample: Orden de compra_03893894.vbs Startdate: 07/10/2026 Architecture: WINDOWS Score: 100 100 keyauth.win 2->100 106 Sigma detected: Powershell launch wmic via class 2->106 108 Suricata IDS alerts for network traffic 2->108 110 Found malware configuration 2->110 112 15 other signatures 2->112 12 wscript.exe 1 2->12         started        15 cmd.exe 2->15         started        17 XWormClient.exe 2->17         started        19 2 other processes 2->19 signatures3 process4 dnsIp5 142 VBScript performs obfuscated calls to suspicious functions 12->142 144 Wscript starts Powershell (via cmd or directly) 12->144 146 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->146 150 2 other signatures 12->150 22 cmd.exe 1 12->22         started        25 cmd.exe 1 12->25         started        148 Suspicious powershell command line found 15->148 27 powershell.exe 15->27         started        29 attrib.exe 15->29         started        31 attrib.exe 15->31         started        33 conhost.exe 17->33         started        102 127.0.0.1 unknown unknown 19->102 35 conhost.exe 19->35         started        signatures6 process7 signatures8 124 Wscript starts Powershell (via cmd or directly) 22->124 37 powershell.exe 22->37         started        39 conhost.exe 22->39         started        42 powershell.exe 15 22->42         started        126 Suspicious powershell command line found 25->126 44 powershell.exe 8 25->44         started        47 conhost.exe 25->47         started        49 cmd.exe 27->49         started        128 Installs a global keyboard hook 33->128 process9 file10 51 powershell.exe 1 46 37->51         started        96 C:\Users\user\AppData\...\537985379810.cmd, ASCII 44->96 dropped 134 Found suspicious powershell code related to unpacking or dynamic code loading 44->134 136 Creates processes via WMI 44->136 138 Installs a global keyboard hook 47->138 140 Wscript starts Powershell (via cmd or directly) 49->140 55 powershell.exe 49->55         started        57 conhost.exe 49->57         started        59 powershell.exe 49->59         started        signatures11 process12 file13 90 C:\Users\user\...\wlan_opt_NEHEHKJTh.cmd, DOS 51->90 dropped 92 C:\Users\user\...\wlan_opt_FJONAOKQ.cmd, ASCII 51->92 dropped 114 Hijacks the control flow in another process 51->114 116 Creates multiple autostart registry keys 51->116 118 Creates an autostart registry key pointing to binary in C:\Windows 51->118 122 3 other signatures 51->122 61 choice.exe 51->61         started        66 conhost.exe 51->66         started        68 powershell.exe 55->68         started        120 Installs a global keyboard hook 57->120 signatures14 process15 dnsIp16 104 203.202.232.254, 1122, 49715, 49716 WHITELABELUS Turkey 61->104 98 C:\Users\user\AppData\...\XWormClient.exe, PE32+ 61->98 dropped 152 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 61->152 154 Creates multiple autostart registry keys 61->154 156 Installs a global keyboard hook 61->156 164 2 other signatures 61->164 70 choice.exe 61->70         started        73 csc.exe 61->73         started        76 conhost.exe 61->76         started        78 WerFault.exe 61->78         started        158 Hijacks the control flow in another process 68->158 160 Writes to foreign memory regions 68->160 162 Maps a DLL or memory area into another process 68->162 80 conhost.exe 68->80         started        82 choice.exe 68->82         started        file17 signatures18 process19 file20 130 Antivirus detection for dropped file 70->130 94 C:\Users\user\AppData\Local\Temp\choice.exe, PE32 73->94 dropped 84 conhost.exe 73->84         started        86 cvtres.exe 73->86         started        132 Installs a global keyboard hook 80->132 88 conhost.exe 82->88         started        signatures21 process22
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e87cd984112c6b57fdb8a9203572da62fd27960e59cfea51cf35a959624c404a
Verdict:
Malware
YARA:
2 match(es)
Tags:
COM Behavior Trace DeObfuscated Obfuscated PowerShell T1027 T1059 T1059.001 T1059.005 VBScript WScript.Shell
Link:
https://app.malva.re/file/2e9dd5681ac91c8f1bfb15aa2addfa41
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e87cd984112c6b57fdb8a9203572da62fd27960e59cfea51cf35a959624c404a/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5b6ntbarfrvvp7nyveqdk4w2ml6spfqolhh6uuopgwuvsysmibfa._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm collection defense_evasion discovery execution persistence privilege_escalation rat trojan
Link:
https://tria.ge/reports/261007-wllncadx3q/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Executes a command shell one-liner
Enumerates video capture drivers
Executes a VBScript file via the Windows Script Host.
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
203.202.232.254:1122
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e87cd984112c6b57fdb8a9203572da62fd27960e59cfea51cf35a959624c404a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91018/

Comments