MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0285278de4f7bb3c087e0ae53e7e4a14e681d61c9ea117cd2b3576679a4b8f35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0285278de4f7bb3c087e0ae53e7e4a14e681d61c9ea117cd2b3576679a4b8f35
SHA3-384 hash:	19a3da7f1260b84435e892e3f741ca36f52e144e987ff4535a55c6e721ded394ad1c481dd3327992af8a1563cc1253de
SHA1 hash:	738aeb2ed9883f189f7be5d4d7b93fba1f92d0f3
MD5 hash:	f422e4977866e8ef6cae7f5c9c225aab
humanhash:	river-may-fix-indigo
File name:	OC_68156306.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	63'929 bytes
First seen:	2026-07-31 12:05:40 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:oC0awvkGdQgMnhW3FsxilHEEoEcGRzl0OE3LXuq+KD728ST0OGN/0WlDb0Y:oC0awvkG6gC7i2HST0OGN/0WlDb0Y
TLSH	T126534AF267D9372CCDC822209BE39B8C6ED4298650ED83F7154FD8D792651B0A8FD462
Magika	javascript
Reporter	James_inthe_box
Tags:	exe js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

176

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm downloader fingerprint powershell repaired

Link:

https://www.filescan.io/uploads/6a6c8f995e140de9783a3055/reports/9504002f-ae9b-4cdb-a11e-56210b66719e/overview

Hybrid Analysis Generik.CZSKZTK trojan

Verdict:

Malicious

Labled as:

Generik.CZSKZTK trojan

Link:

https://www.hybrid-analysis.com/sample/0285278de4f7bb3c087e0ae53e7e4a14e681d61c9ea117cd2b3576679a4b8f35

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-30T12:43:00Z UTC

Last seen:

2026-08-02T05:14:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/0285278de4f7bb3c087e0ae53e7e4a14e681d61c9ea117cd2b3576679a4b8f35/results?tab=lookup

Nucleon Malprob Susipicious

Score:

48%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/0285278de4f7bb3c087e0ae53e7e4a14e681d61c9ea117cd2b3576679a4b8f35

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0285278de4f7bb3c087e0ae53e7e4a14e681d61c9ea117cd2b3576679a4b8f35/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-30 22:30:20 UTC

File Type:

Binary

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=akcspdpe665tycd6blst47skcttidvq4t2qrptjlgv3gpgslr42q._file

Threatray XWorm

Verdict:

malicious

Label(s):

XWorm

Alert

Create hunting rule

Link:

https://reports.threatray.com/13b4dc5d-8272-4e2e-b205-1e65eff069d5

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution persistence rat trojan

Link:

https://tria.ge/reports/260731-n9kryssdkh/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Badlisted process makes network request

Detect Xworm Payload

Family: Xworm

Process spawned unexpected child process

Malware Config

C2 Extraction:

64.89.162.178:7007

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/0285278de4f7bb3c087e0ae53e7e4a14e681d61c9ea117cd2b3576679a4b8f35