# Common default passwords used to protect malware-sample archives and encrypted malicious documents (Hexacorn research, incl. Excel VelvetSweatshop)

> Hexacorn compiled the passwords most commonly used on malware-sample archives (malware, virus, infected, 1337, 123456, VelvetSweatshop and others) using AI-assisted searching plus manual validation. Knowing these passwords helps defenders triage and unpack password-protected archives, and the VelvetSweatshop entry maps to a documented antivirus-evasion technique used in real Excel malware campaigns.

- **Published:** 2026-10-24T21:42:57Z
- **Last reviewed:** 2026-10-24T21:42:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4417
- **ID:** TL-2026-4417
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2012-0158, CVE-2017-11882

## Description

On 2026-10-24 the Hexacorn blog published part 2 of its 'Solving practical problems with AI' series, listing the passwords most popular for protecting malicious archives. The compiled list includes traditional passwords (malware, virus, infected, inf3cted, pass, god, qwerty, p@ssword), numeric passwords (1337, 123, 1234, 123456, 12345678, 123456789, 111111, 8466) and passwords tied to specific sample-sharing communities or vendors (mysubsarethebest, history, virussign, infected_pcap, infected666, velvet, VelvetSweatshop, S1BinaryVault, shipped, invoice, doc, clean). The post names its sources: the GitHub repository LJ9859/Malware-Database (1337), MalwareWatch (mysubsarethebest), snorrefagerland.github.io/virushistory (history), Kaspersky support documentation (pass), abuse.ch samples (123, 8466), a Reddit SentinelOne XDR discussion (S1BinaryVault) and the virussign.com free list (virussign). The infected666 convention places an extra character before the zip extension. The post describes an iterative AI workflow, starting from a Google search and then asking follow-up questions to widen the candidate list. Its stated conclusion is that the prompts that produced the list matter more than the list itself. The post discusses no malware families, CVEs, IOCs, actors or campaigns.

The list is mostly a research-sharing convention rather than an attack. Two entries still have defensive relevance for adversary tradecraft. 'invoice', 'doc' and 'shipped' are generic words consistent with social-engineering lures. 'VelvetSweatshop' is not a sharing convention. It is the hard-coded default key that Microsoft Excel tries automatically when opening encrypted workbooks, so a file encrypted with it opens without a password prompt. Threatpost (2020-03-31) reported it resurrected in a LimeRAT campaign using read-only encrypted Excel files, and tied the technique to CVE-2012-0158 and to 2012-era use. VMware Carbon Black's Threat Analysis Unit (2020-11-19) documented encrypted samples exploiting CVE-2017-11882 and reported that VelvetSweatshop encryption cut antivirus detection by more than 50%. AES-256-encrypted samples were detected by under 15% of the engines tested, and five products missed the AES-128 and AES-256 variants entirely.

Defender value: SOC and malware-triage teams can use the list as a first-pass wordlist when unpacking quarantined or shared archives. Detection engineers should note that archive passwords are weak signals on their own and need pairing with file-type, delivery-channel and behavioral context. Email and endpoint scanners should attempt known default passwords, VelvetSweatshop in particular, when inspecting Office documents. Severity is LOW and informational: the source describes no active exploitation, but the VelvetSweatshop evasion technique has been exploited in the wild per the cited vendor reports.

## MITRE ATT&CK

- T1027 Obfuscated Files or Information
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1203 Exploitation for Client Execution

## Sources

- [Solving practical problems with AI, part 2: the most popular and most commonly used passwords for malicious archives](https://www.hexacorn.com/blog/2026/10/24/solving-practical-problems-with-ai-part-2-the-most-popular-and-most-commonly-used-passwords-for-malicious-archives/)
- [8-Year-Old VelvetSweatshop Bug Resurrected in LimeRAT Campaign (Threatpost)](https://threatpost.com/velvetsweatshop-bug-resurrected-limerat/154310)
- [VelvetSweatshop: When default passwords can still make a difference (VMware Security Blog)](https://blogs.vmware.com/security/2020/11/velvetsweatshop-when-default-passwords-can-still-make-a-difference.html)
- [Attackers Leverage Excel File Encryption to Deliver Malware (Dark Reading)](https://www.darkreading.com/cyberattacks-data-breaches/attackers-leverage-excel-file-encryption-to-deliver-malware)
- [VelvetSweatshop: Microsoft Excel spreadsheet encryption rises again to deliver LimeRAT (Mimecast)](https://mimecast.com/blog/velvetsweatshop-microsoft-excel-spreadsheet-encryption-rises-again-to-deliver-limerat-malware)
- [Excel Malspam: Password Protected, Not! (LevelBlue SpiderLabs)](https://www.levelblue.com/blogs/spiderlabs-blog/excel-malspam-password-protected-not)
- [NVD: CVE-2012-0158](https://nvd.nist.gov/vuln/detail/CVE-2012-0158)
- [NVD: CVE-2017-11882](https://nvd.nist.gov/vuln/detail/CVE-2017-11882)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4417