MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 258d4284668737bc7cab189eda70ef0476f2c9813e9dfd0f3dcf249a2cc64e19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	258d4284668737bc7cab189eda70ef0476f2c9813e9dfd0f3dcf249a2cc64e19
SHA3-384 hash:	bdfdf81732c84a5d3830d76f54ef6d9744eea62ceb2de38799f19c64c15056a191a51f27cbf2012488d790458fce63d6
SHA1 hash:	0e34f7a8362ba33e74c8002b27d95df8ba4b6f73
MD5 hash:	209603b8ede2d28433e7aadfc46d7258
humanhash:	alpha-bacon-nitrogen-washington
File name:	6736547634-394676254XRFQ_PDF.rar
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	810'601 bytes
First seen:	2026-07-24 12:17:57 UTC
Last seen:	2026-07-24 12:34:29 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:wK+CW1P56W96vWBEYUR5nd+zzp4QCbcQv4vh5uFqJrl4lLjFGbnneI2Dfra:wKlW1R56uBagSQ3QahfJrmAbneI2Dfra
TLSH	T190052320BD6B5D7ECA13243739A5B5FA6749E0848D228449F3EBB307F541F8D78819B8
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar xworm

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

74

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	6736547634-394676254 RFQ_PDF.JS
File size:	2'538'183 bytes
SHA256 hash:	3738537154bfc5ea1b5af6034602c550f603deb11cbbef3018f668f4907f4d37
MD5 hash:	6e83e5fcc8783b5a1356fa32c8080110
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9a702507-28bc-4189-8724-106c12334225/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive masquerade obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a63581ffcfd36e3774d78ba/reports/82dcab12-6cd8-4f64-81de-6b4bb5a8390e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/258d4284668737bc7cab189eda70ef0476f2c9813e9dfd0f3dcf249a2cc64e19

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-15T07:07:00Z UTC

Last seen:

2026-07-17T06:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/258d4284668737bc7cab189eda70ef0476f2c9813e9dfd0f3dcf249a2cc64e19/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/209603b8ede2d28433e7aadfc46d7258

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/258d4284668737bc7cab189eda70ef0476f2c9813e9dfd0f3dcf249a2cc64e19/

ReversingLabs TitaniumCloud Script.Packed.Generic

Threat name:

Script.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-15 10:02:05 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

14 of 36 (38.89%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ewgufbdgq433y7fldcpnu4hpar3pfsmbh2o72dz5z4sjulggjymq._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:xworm execution loader persistence rat trojan

Link:

https://tria.ge/reports/260724-p4h7lsem6w/

Behaviour

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Checks computer location settings

Executes dropped EXE

Detect Xworm Payload

Detects DonutLoader

Family: DonutLoader

Family: Xworm

Malware Config

C2 Extraction:

104.239.66.185:7004

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/258d4284668737bc7cab189eda70ef0476f2c9813e9dfd0f3dcf249a2cc64e19