MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea2202c4b0c1249b69feae8f54620de216873ced23bb957931fcf943f73e8ef9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ea2202c4b0c1249b69feae8f54620de216873ced23bb957931fcf943f73e8ef9
SHA3-384 hash:	407734320929bfe45cd2dd98e7623f8fc36990399c1cb60a5439d014be96a6038e934e77b5e5eb47686a9d76a66cf384
SHA1 hash:	9c284a5c26d1ffc4718c97ae634f54c4c6c69ff5
MD5 hash:	9958ce306d13872e1e7bb477c867c524
humanhash:	saturn-kansas-don-sixteen
File name:	H09876567890009.JS
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	6'887'919 bytes
First seen:	2025-06-30 14:00:03 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:GfHofoVqiiAeUyZ+TRNYPUJISd3Zy1nYAF8gVXVFRfjvnx3BhIz/VmhCoqEuOhHJ:Gfq
Threatray	27 similar samples on MalwareBazaar
TLSH	T11D664F9E8D0BF7833142DFE0BA88AD9AE07B96C317027A7070DC5D09B35DD6629DC658
Magika	javascript
Reporter	abuse_ch
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

288

Origin country :

SE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.JS.Obfus-2525.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.JS.Obfus-2179.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686298ba37c343677947cc02

Tags:

autorun emotet delphi

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context dropper evasive fingerprint keylogger obfuscated packed

Link:

https://www.filescan.io/uploads/6862989eee5b1c8f3d212cb3/reports/5f6f566b-e9fb-4ece-8358-3b7ee7886c70/overview

Hybrid Analysis Trojan/JS.Obfuscator

Verdict:

Malicious

Labled as:

Trojan/JS.Obfuscator

Link:

https://www.hybrid-analysis.com/sample/ea2202c4b0c1249b69feae8f54620de216873ced23bb957931fcf943f73e8ef9

Joe Sandbox DBatLoader, PureLog Stealer, XWorm

Result

Threat name:

DBatLoader, PureLog Stealer, XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1725623

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Allocates many large memory junks

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Drops PE files with a suspicious file extension

Found malware configuration

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected DBatLoader

Yara detected PureLog Stealer

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ea2202c4b0c1249b69feae8f54620de216873ced23bb957931fcf943f73e8ef9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ea2202c4b0c1249b69feae8f54620de216873ced23bb957931fcf943f73e8ef9/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5irafrfqyesjw2p6v2hviyqn4iliophneo5zk6jr7t4uh5z6r34q._file

Threatray dbatloader unc_loader_001

Verdict:

malicious

Label(s):

dbatloader

Alert

Create hunting rule

unc_loader_001

Alert

Create hunting rule

Similar samples:

373a59724445fe6a91b6c0d1aff0ec54277faf061a4960d0e7e13fcebedfa709

XWorm

5f8469ff520ad563203f02d05f56eb5733cac27fb4361dc15ff3bc80aa78745d

XWorm

7ccc6e02a9571b7e04dd21f1571e3db4f5af3c61d6fbb17c691014621a4b4eb7

XWorm

a7d85600396969e5a2210cdc61f7f6efbbe15a279bfd65de8fa448a7ce0f354f

XWorm

e96a2b993722bee3393df92be9f4ec233673a7057c4fc8d31c5463f28368994b

XWorm

ea2202c4b0c1249b69feae8f54620de216873ced23bb957931fcf943f73e8ef9

XWorm

error

XWorm

+ 17 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:modiloader family:xworm collection discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/250630-rbc61acl6s/

Behaviour

Runs ping.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

ModiLoader Second Stage

Detect Xworm Payload

ModiLoader, DBatLoader

Modiloader family

Xworm

Xworm family

VMRay RedNet

Malware family:

RedNet

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ea2202c4b0c1/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ea2202c4b0c1249b69feae8f54620de216873ced23bb957931fcf943f73e8ef9