MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f4073f71a9d0616905a018e6f42c60530ffaad1cba3f1057d3f47b82fa3f90e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 14
| SHA256 hash: | f4073f71a9d0616905a018e6f42c60530ffaad1cba3f1057d3f47b82fa3f90e5 |
|---|---|
| SHA3-384 hash: | 6ef74f9f151b1a99c773b3189980ac8836f5af4925ef023cf0a6086d679d28895a904bb13b158368c45eca8d9155e0b9 |
| SHA1 hash: | a777e12145311054fadecfe0941ffc6085add989 |
| MD5 hash: | 9b213a96c508337ac71d9a8ac3bfca0c |
| humanhash: | social-pizza-massachusetts-jupiter |
| File name: | rAWBDHL7214306201.vbs |
| Download: | download sample |
| Signature | XWorm |
| File size: | 220'254 bytes |
| First seen: | 2025-11-12 15:00:13 UTC |
| Last seen: | 2025-11-14 14:59:11 UTC |
| File type: |  vbs |
| MIME type: | text/plain |
| ssdeep | 6144:Ps1/DDO/vX03jIBxkez881JgwJsbObq2ymmLdR/V3Gaofbu0KFl2:jLUBNGuO |
| Threatray | 1'585 similar samples on MalwareBazaar |
| TLSH | T1BC24D82802915D68CBA1337125BFFF70143AF24D99241A72C9DEA0EC5D7A1CCF7DA9A4 |
| Magika | vba |
| Reporter |  FXOLabs |
| Tags: | vbs xworm |
Intelligence
File Origin
# of uploads :
3
# of downloads :
87
Origin country :
BRVendor Threat Intelligence
Detection:
XWorm
Detection(s):
Verdict:
Malicious
Score:
94.1%
Tags:
obfuscate xtreme shell
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm base64 cmd evasive fingerprint lolbin masquerade obfuscated powershell
Verdict:
Suspicious
Labled as:
JS/Agent.DGI
Verdict:
Malicious
File Type:
vbs
First seen:
2025-11-12T08:49:00Z UTC
Last seen:
2025-11-14T12:42:00Z UTC
Hits:
~1000
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.VBS.SAgent.gen HEUR:Trojan.Script.Generic HEUR:Trojan.PowerShell.Tesre.sb Backdoor.Agent.TCP.C&C Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan-Downloader.Script.Generic Trojan.PowerShell.AmsiBypass.sb
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated Obfuscated SCRIPTING.FILESYSTEMOBJECT T1059.005 VBScript
Verdict:
Malicious
Threat:
Family.XWORM
Threat name:
Script-WScript.Backdoor.Xworm
Status:
Suspicious
First seen:
2025-11-12 15:00:38 UTC
File Type:
Text (VBS)
AV detection:
10 of 38 (26.32%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
xworm
Similar samples:
+ 1'575 additional samples on MalwareBazaar
Malware family:
XWorm
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.