🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6712253ca1dacf218db78cc5956828ed7d05d091e9fa5bcada0167f2f10f45c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6712253ca1dacf218db78cc5956828ed7d05d091e9fa5bcada0167f2f10f45c
SHA3-384 hash: 11356faf223bb4a699405bc96c5516004dfced897fb4fd2770b58af92e829a2258c8b085262104922d3b2ba92032e57e
SHA1 hash: 8353e08d8d8ae3bc7395190018d778704aa0a183
MD5 hash: 0fd0bf561ffa300241762fd2991efe51
humanhash: magazine-lactose-snake-whiskey
File name:Orden de compra.js
Download: download sample
Signature XWorm
Create hunting rule
File size:443'260 bytes
First seen:2026-10-08 19:25:55 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:t5omuT+xtFqngSI7VCIiO4WlpMXFako9IGN8Ksc2D4MQnQT/CGPZ/AG5hP:tRRVhN1Eo9IGN8dEMQeP3r
TLSH T16794BFA62746F4A005BD8B236B7B5B3921FB0FF4224DDE0883458BDD1364640DAF5DEA
Magika javascript
Reporter abuse_ch
Tags:js xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Other.Malware-gen.77153899.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
attrib evasive obfuscated powershell repaired
Link:
https://www.filescan.io/uploads/6ac7ee61969f6f5907ee1d7d/reports/9db46301-46ef-4d35-8e22-37fea7d51725/overview
Verdict:
Malicious
Labled as:
JS/Obfuscated.CT trojan
Link:
https://www.hybrid-analysis.com/sample/f6712253ca1dacf218db78cc5956828ed7d05d091e9fa5bcada0167f2f10f45c
Verdict:
Malicious
File Type:
js
First seen:
2026-10-08T12:47:00Z UTC
Last seen:
2026-10-09T20:06:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/f6712253ca1dacf218db78cc5956828ed7d05d091e9fa5bcada0167f2f10f45c/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1984491
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation Via Stdin
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell launch wmic via class
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1984491 Sample: Orden de compra.js Startdate: 08/10/2026 Architecture: WINDOWS Score: 100 119 keyauth.win 2->119 135 Sigma detected: Powershell launch wmic via class 2->135 137 Suricata IDS alerts for network traffic 2->137 139 Found malware configuration 2->139 141 15 other signatures 2->141 13 wscript.exe 1 1 2->13         started        16 conhost.exe 2->16         started        18 conhost.exe 2->18         started        20 4 other processes 2->20 signatures3 process4 signatures5 175 JScript performs obfuscated calls to suspicious functions 13->175 177 Wscript starts Powershell (via cmd or directly) 13->177 179 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->179 183 2 other signatures 13->183 22 cmd.exe 1 13->22         started        25 powershell.exe 8 13->25         started        28 cmd.exe 16->28         started        30 cmd.exe 18->30         started        181 Installs a global keyboard hook 20->181 32 cmd.exe 20->32         started        34 conhost.exe 20->34         started        36 conhost.exe 20->36         started        process6 file7 143 Suspicious powershell command line found 22->143 145 Wscript starts Powershell (via cmd or directly) 22->145 147 Uses cmd line tools excessively to alter registry or file data 22->147 149 Uses attrib.exe to hide files 22->149 38 powershell.exe 22->38         started        40 conhost.exe 22->40         started        43 powershell.exe 15 22->43         started        45 attrib.exe 22->45         started        109 C:\Users\user\AppData\...\172659955434651.cmd, ASCII 25->109 dropped 151 Found suspicious powershell code related to unpacking or dynamic code loading 25->151 47 conhost.exe 25->47         started        49 powershell.exe 28->49         started        51 3 other processes 28->51 53 3 other processes 30->53 55 3 other processes 32->55 153 Installs a global keyboard hook 34->153 signatures8 process9 signatures10 57 powershell.exe 1 46 38->57         started        155 Installs a global keyboard hook 40->155 61 cmd.exe 49->61         started        process11 file12 111 C:\Users\user\...\tile_db_RSPSDRNJh.cmd, DOS 57->111 dropped 113 C:\Users\user\...\tile_db_ACTSJCUC.cmd, ASCII 57->113 dropped 115 C:\Users\user\AppData\Local\...\tile_db.dat, ASCII 57->115 dropped 157 Hijacks the control flow in another process 57->157 159 Creates multiple autostart registry keys 57->159 161 Creates an autostart registry key pointing to binary in C:\Windows 57->161 165 3 other signatures 57->165 63 choice.exe 57->63         started        68 conhost.exe 57->68         started        163 Wscript starts Powershell (via cmd or directly) 61->163 70 powershell.exe 61->70         started        72 conhost.exe 61->72         started        74 powershell.exe 61->74         started        signatures13 process14 dnsIp15 121 203.202.232.254, 1122, 49742 WHITELABELUS Turkey 63->121 107 C:\Users\user\AppData\...\XWormClient.exe, PE32+ 63->107 dropped 125 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 63->125 127 Tries to steal Mail credentials (via file / registry access) 63->127 129 Creates multiple autostart registry keys 63->129 133 2 other signatures 63->133 76 choice.exe 63->76         started        79 csc.exe 63->79         started        82 csc.exe 63->82         started        84 conhost.exe 63->84         started        131 Installs a global keyboard hook 68->131 86 powershell.exe 70->86         started        file16 signatures17 process18 file19 167 Antivirus detection for dropped file 76->167 117 C:\Users\user\AppData\Local\Temp\choice.exe, PE32 79->117 dropped 88 conhost.exe 79->88         started        90 cvtres.exe 79->90         started        92 conhost.exe 82->92         started        94 cvtres.exe 82->94         started        169 Hijacks the control flow in another process 86->169 171 Writes to foreign memory regions 86->171 173 Maps a DLL or memory area into another process 86->173 96 conhost.exe 86->96         started        99 choice.exe 86->99         started        101 choice.exe 86->101         started        signatures20 process21 signatures22 123 Installs a global keyboard hook 96->123 103 conhost.exe 99->103         started        105 conhost.exe 101->105         started        process23
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f6712253ca1dacf218db78cc5956828ed7d05d091e9fa5bcada0167f2f10f45c
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
PowerShell T1059.001
Link:
https://app.malva.re/file/0fd0bf561ffa300241762fd2991efe51
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6712253ca1dacf218db78cc5956828ed7d05d091e9fa5bcada0167f2f10f45c/
Threat name:
Script-BAT.Dropper.Powecod
Create hunting rule
Status:
Malicious
First seen:
2026-10-08 19:14:19 UTC
File Type:
Text (Batch)
AV detection:
12 of 38 (31.58%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6zyseu6kdwwpegg3pdgfsvucr3l5axijd2p2lpfnualh6lyq6roa._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm defense_evasion discovery execution persistence privilege_escalation rat trojan
Link:
https://tria.ge/reports/261008-x5ngqasycv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Enumerates video capture drivers
Hide Artifacts: Hidden Files and Directories
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
203.202.232.254:1122
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f6712253ca1dacf218db78cc5956828ed7d05d091e9fa5bcada0167f2f10f45c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments