🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f24db3436d2ac8be97a79320c86778003b28ecc72b94dde7d8a42f815f469061. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f24db3436d2ac8be97a79320c86778003b28ecc72b94dde7d8a42f815f469061
SHA3-384 hash: 1515dc9c79268382ebeaf58f744b84624e9e85ee65ed1202f9b8b2a08000c1923f28f348850745c705506c5a3c7ca5cb
SHA1 hash: ebabd3cc0baf8997527a0446a9353678cc23336a
MD5 hash: c73667735ce0f637b764c8d9f691f41f
humanhash: low-glucose-rugby-edward
File name:comprobante de pago_509680_xls.vbs
Download: download sample
Signature XWorm
Create hunting rule
File size:32'905 bytes
First seen:2026-10-30 19:17:47 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:KHa7LNUoE/Ux0HwSdn8v9CYw0xil7aODU/VhafeZPLL5XBScSx224rXG/WOB3WVR:KumpHruxwRJkWn+Fyy5LM+
TLSH T175E262369831CBF0D93A35A3658F7417DA10C36EA839A90F398F91493B35634CBD64A7
Magika vba
Reporter abuse_ch
Tags:ESP geo vbs xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96243/
Detection(s):
SecuriteInfo.com.Script.SNH-gen.83127482.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae4ed94b121dd519dceee6b
Tags:
obfuscate valyria shell sage
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6ae4ed88ae6848e9a9d1b759/reports/7bc93516-4626-4961-aac7-b6d773c7a97b/overview
Verdict:
Malicious
Labled as:
Valyria
Link:
https://www.hybrid-analysis.com/sample/f24db3436d2ac8be97a79320c86778003b28ecc72b94dde7d8a42f815f469061
Verdict:
Malicious
File Type:
vbs
First seen:
2026-10-30T12:26:00Z UTC
Last seen:
2026-10-31T22:12:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/f24db3436d2ac8be97a79320c86778003b28ecc72b94dde7d8a42f815f469061/results?tab=lookup
Result
Threat name:
ResolverRAT, XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1995521
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Connects to many ports of the same IP (likely port scanning)
Contains functionality to prevent local Windows debugging
Drops PE files with benign system names
Encrypted powershell cmdline option found
Excessive usage of taskkill to terminate processes
Found many strings related to Crypto-Wallets (likely being stolen)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected ResolverRAT
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1995521 Sample: comprobante de pago_509680_... Startdate: 30/10/2026 Architecture: WINDOWS Score: 100 119 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->119 121 c.pki.goog 2->121 123 6 other IPs or domains 2->123 129 Suricata IDS alerts for network traffic 2->129 131 Malicious sample detected (through community Yara rule) 2->131 133 Antivirus detection for dropped file 2->133 135 12 other signatures 2->135 11 wscript.exe 1 2->11         started        14 wscript.exe 2->14         started        16 wscript.exe 2->16         started        18 9 other processes 2->18 signatures3 process4 signatures5 157 VBScript performs obfuscated calls to suspicious functions 11->157 159 Wscript starts Powershell (via cmd or directly) 11->159 161 Windows Scripting host queries suspicious COM object (likely to drop second stage) 11->161 163 Suspicious execution chain found 11->163 20 powershell.exe 11->20         started        165 WScript reads language and country specific registry keys (likely country aware script) 14->165 23 powershell.exe 14->23         started        25 powershell.exe 16->25         started        167 Contains functionality to prevent local Windows debugging 18->167 27 powershell.exe 18->27         started        29 powershell.exe 18->29         started        31 powershell.exe 18->31         started        33 3 other processes 18->33 process6 signatures7 137 Suspicious powershell command line found 20->137 35 AppLaunch.exe 20->35         started        40 powershell.exe 10 20->40         started        42 3 other processes 20->42 44 6 other processes 23->44 46 5 other processes 25->46 48 5 other processes 27->48 50 5 other processes 29->50 52 5 other processes 31->52 54 8 other processes 33->54 process8 dnsIp9 125 203.202.232.254, 1122, 49739 WHITELABELUS Turkey 35->125 127 187.52.45.38, 49740, 56932 VtalBR United States 35->127 97 C:\Users\user\AppData\...\XWormClient.exe, PE32 35->97 dropped 99 C:\Users\user\AppData\...\vhqbpgnetchk.exe, PE32+ 35->99 dropped 139 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 35->139 141 Installs a global keyboard hook 35->141 56 3 other processes 35->56 143 Found many strings related to Crypto-Wallets (likely being stolen) 40->143 60 2 other processes 40->60 111 2 other malicious files 42->111 dropped 62 2 other processes 42->62 101 C:\Users\user\AppData\Local\...\tel5gaoj.dll, PE32 44->101 dropped 64 4 other processes 44->64 103 C:\Users\user\AppData\Local\...\0cdfczw2.dll, PE32 46->103 dropped 66 4 other processes 46->66 105 C:\Users\user\AppData\Local\...\0givdne2.dll, PE32 48->105 dropped 68 4 other processes 48->68 107 C:\Users\user\AppData\Local\...\jkajjer1.dll, PE32 50->107 dropped 70 4 other processes 50->70 109 C:\Users\user\AppData\Local\...\3z3ayqym.dll, PE32 52->109 dropped 72 4 other processes 52->72 113 3 other malicious files 54->113 dropped 74 4 other processes 54->74 file10 signatures11 process12 file13 115 C:\Users\user\AppData\Roaming\svchost.exe, PE32+ 56->115 dropped 117 C:\Users\user\AppData\Local\...\AppLaunch.exe, PE32 56->117 dropped 145 Antivirus detection for dropped file 56->145 147 Multi AV Scanner detection for dropped file 56->147 149 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 56->149 155 6 other signatures 56->155 81 3 other processes 56->81 76 conhost.exe 60->76         started        83 3 other processes 60->83 85 4 other processes 64->85 79 conhost.exe 66->79         started        87 3 other processes 66->87 89 4 other processes 68->89 91 4 other processes 70->91 151 Excessive usage of taskkill to terminate processes 72->151 93 4 other processes 72->93 153 Installs a global keyboard hook 74->153 signatures14 process15 signatures16 169 Installs a global keyboard hook 76->169 95 conhost.exe 81->95         started        process17
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f24db3436d2ac8be97a79320c86778003b28ecc72b94dde7d8a42f815f469061
Verdict:
Malware
YARA:
1 match(es)
Tags:
COM Behavior Trace DeObfuscated Obfuscated Scripting.Dictionary Scripting.FileSystemObject SOS: 0.64 T1027 T1059 T1059.005 VBScript WScript.Network WScript.Shell
Link:
https://app.malva.re/file/c73667735ce0f637b764c8d9f691f41f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f24db3436d2ac8be97a79320c86778003b28ecc72b94dde7d8a42f815f469061/
Threat name:
Script-WScript.Backdoor.XWorm
Create hunting rule
Status:
Malicious
First seen:
2026-10-30 19:18:37 UTC
File Type:
Text (VBS)
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6jg3gq3nflel5f5hsmqmqz3yaa5sr3ghfokn3z6yuqxycx2gsbqq._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/8b55be50-0f16-4365-bec3-949abde09cea
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm defense_evasion discovery execution persistence rat trojan
Link:
https://tria.ge/reports/261030-xz6q4sfy5q/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Enumerates video capture drivers
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
203.202.232.254:1122
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f24db3436d2ac8be97a79320c86778003b28ecc72b94dde7d8a42f815f469061

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:MULTI_Malware_GuLoader_ForgeAuto_2fbadefd
Create hunting rule
Author:Marjoriefort
Description:Detects GuLoader (inconnu, etat binaire)
Rule name:MULTI_Malware_MassLogger_ForgeAuto_885f4a8f
Create hunting rule
Author:Marjoriefort
Description:Detects MassLogger (inconnu, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/96243/

Comments