MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 620b824bc1426bd64f3c0ce6fad30fb38d50a411dc70429964ed8ca65b0ff5ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	620b824bc1426bd64f3c0ce6fad30fb38d50a411dc70429964ed8ca65b0ff5ce
SHA3-384 hash:	189319d3ce2b70748413f917f81d8f7263c135d0c6eec8422bde7e73df33d2140fdd41287fd4b74bacb559420cdde25d
SHA1 hash:	ea736fc29f68365aca89e2654d280af97ca68543
MD5 hash:	7ad0444c95a4d29d8d743db722812f1b
humanhash:	north-aspen-carbon-social
File name:	073126-Purchase_OrderXs.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	872'443 bytes
First seen:	2026-08-03 11:24:08 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:27di9vAUJ8IH7UPg+uiRUmu/QuIuXgEvszF14ukkceYhGVFUQ8XEu0u78u+R4qXM:p
TLSH	T1AD05A7E25A5F0056C486BBC69CDDA7FF262466096C480BAD3277C6A04E0BC5D047EF7B
Magika	javascript
Reporter	TomU
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

55

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

downloader masquerade repaired

Link:

https://www.filescan.io/uploads/6a7085825dcebd44785c4b21/reports/7136bafe-93ed-480b-a425-79ca4ac7a33c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/620b824bc1426bd64f3c0ce6fad30fb38d50a411dc70429964ed8ca65b0ff5ce

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-30T21:36:00Z UTC

Last seen:

2026-08-03T07:56:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/620b824bc1426bd64f3c0ce6fad30fb38d50a411dc70429964ed8ca65b0ff5ce/results?tab=lookup

Nucleon Malprob Benign

Score:

17%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/620b824bc1426bd64f3c0ce6fad30fb38d50a411dc70429964ed8ca65b0ff5ce

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/620b824bc1426bd64f3c0ce6fad30fb38d50a411dc70429964ed8ca65b0ff5ce/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-31 03:58:15 UTC

File Type:

Binary

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mifyes6bijv5mtz4bttpvuypwogvbjar3ryefgle5wgkmwyp6xha._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm defense_evasion discovery execution persistence privilege_escalation pyinstaller rat spyware stealer trojan upx

Link:

https://tria.ge/reports/260803-njtxyaxxfx/

Behaviour

Kills process with taskkill

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Detects Pyinstaller

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

UPX packed file

Creates a file in the Startup directory

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Badlisted process makes network request

Detect Xworm Payload

Family: Xworm

Process spawned unexpected child process

Malware Config

C2 Extraction:

31.57.184.10:5050

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.85

Link:

https://yomi.yoroi.company/submissions/620b824bc1426bd64f3c0ce6fad30fb38d50a411dc70429964ed8ca65b0ff5ce