MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bf8a7e3f3152e3bfc8bc0fcbc6aa3a8911eb60f36e9f1f9fe3db441d2c7baac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bf8a7e3f3152e3bfc8bc0fcbc6aa3a8911eb60f36e9f1f9fe3db441d2c7baac
SHA3-384 hash: 4ae808a58f4b3b3f00909b6cb782495f7a700924d098ca64303e8e3f13b43835ffaf53b046965d9d5eb3b1ca72acb5b8
SHA1 hash: f196af78c4043647ca45bf5e1586766a8a9987e7
MD5 hash: db80c0b2d999cb784ff3fe15c1c4274c
humanhash: glucose-music-triple-double
File name:COMPROBANTE DE PAGO DE BBVA.js
Download: download sample
Signature XWorm
Create hunting rule
File size:1'113'692 bytes
First seen:2026-08-22 11:12:04 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:YV6dg8QDdY7jLkmLiK5QLfKsCbxoJ8xfvUL400zXxRhgcWWPdkQ:jd
TLSH T15F35C489C84ED4A3CB6EFAC7FCE4E9310DE5BC4A116B1AF122F6492962127075DD0B74
Magika javascript
Reporter abuse_ch
Tags:js xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader obfuscated repaired xworm
Link:
https://www.filescan.io/uploads/6a898415688c9454d71b907b/reports/8fe55929-fe80-4205-86ee-8128ce23589d/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1bf8a7e3f3152e3bfc8bc0fcbc6aa3a8911eb60f36e9f1f9fe3db441d2c7baac
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1962188
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Creates processes via WMI
JavaScript source code contains functionality to generate code involving a shell, file or stream
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Drops script at startup location
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1962188 Sample: COMPROBANTE DE PAGO DE BBVA.js Startdate: 22/08/2026 Architecture: WINDOWS Score: 100 22 sunix-technology.com 2->22 26 Antivirus detection for URL or domain 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Sigma detected: Drops script at startup location 2->30 32 3 other signatures 2->32 8 wscript.exe 1 3 2->8         started        11 wscript.exe 1 2->11         started        signatures3 process4 signatures5 34 Wscript starts Powershell (via cmd or directly) 8->34 36 Obfuscated command line found 8->36 38 Bypasses PowerShell execution policy 8->38 40 3 other signatures 8->40 13 powershell.exe 14 15 11->13         started        16 powershell.exe 11->16         started        process6 dnsIp7 24 sunix-technology.com 192.232.216.135, 443, 49714, 49716 UNIFIEDLAYER-AS-1-UnifiedLayerUS United States 13->24 18 conhost.exe 13->18         started        20 conhost.exe 16->20         started        process8
Score:
26%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/1bf8a7e3f3152e3bfc8bc0fcbc6aa3a8911eb60f36e9f1f9fe3db441d2c7baac
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bf8a7e3f3152e3bfc8bc0fcbc6aa3a8911eb60f36e9f1f9fe3db441d2c7baac/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-22 00:58:57 UTC
File Type:
Text (JavaScript)
AV detection:
5 of 36 (13.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dp4kpy7tcuxdx7elyd6ly2vdvcir5nqpg3u7d6p6hw2eduwhxkwa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution persistence privilege_escalation
Link:
https://tria.ge/reports/260822-na2w7ax1av/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Command and Scripting Interpreter: PowerShell
Creates a file in the Startup directory
Badlisted process makes network request
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://sunix-technology.com/images/MSI_PRO.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/1bf8a7e3f3152e3bfc8bc0fcbc6aa3a8911eb60f36e9f1f9fe3db441d2c7baac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments