MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 670063d3c24ab6645205ede5d31c9ceaeefccdf0e3f0be21cdc46fb44ed69a01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XWorm
Vendor detections: 8
| SHA256 hash: | 670063d3c24ab6645205ede5d31c9ceaeefccdf0e3f0be21cdc46fb44ed69a01 |
|---|---|
| SHA3-384 hash: | 84251715f7731c4caf877168b067467339db0a6e10214b1a074493482f19fc964bf39cbf3ebacd6cd2b901329dc5955d |
| SHA1 hash: | 455d841210524c28cfb2e8a9e6a47f94b1dc4d8c |
| MD5 hash: | 6b4a9d17da04395fb38a338abf0f0cdc |
| humanhash: | mississippi-undress-oklahoma-speaker |
| File name: | PaymentXAdviceX-XAdviceXRefXXA2sv8yynp3xeXXXACHXcreditsXXCustomerXRefXX2011001664XXXSecondXPartyXRefXREM-204169X.rar |
| Download: | download sample |
| Signature | XWorm |
| File size: | 885'168 bytes |
| First seen: | 2026-07-24 12:15:40 UTC |
| Last seen: | 2026-07-24 12:39:37 UTC |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 24576:IzTvYTBXJBxqzdce94Bf1D4HmR13yNm7XVelsr1UQaG:I8JBx9f2H83im7Fels5UtG |
| TLSH | T1A51533C49DB656118A3B723764E229DE1E0AE5783DFC19AFF2412D7352B838F5C4A813 |
| TrID | 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1) |
| Magika | rar |
| Reporter |  TomU |
| Tags: | rar xworm |
Intelligence
File Origin
# of uploads :
2
# of downloads :
53
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Payment Advice - Advice Ref [A2sv8yynp3xe] ACH credits Customer Ref [2011001664] Second Party Ref[REM-204169].JS |
|---|---|
| File size: | 2'607'095 bytes |
| SHA256 hash: | 09edc26a677870826648f171934793b831705359b356e7436751aab956921fd9 |
| MD5 hash: | 134db7ea93e75b49cfea4147ffc7c644 |
| MIME type: | text/plain |
| Signature | XWorm |
Vendor Threat Intelligence
Detection(s):
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug downloader dropper evasive masquerade obfuscated packed repaired xloader
Verdict:
Malicious
File Type:
rar
First seen:
2026-07-09T14:34:00Z UTC
Last seen:
2026-07-21T02:47:00Z UTC
Hits:
~10
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Rar Archive
Threat name:
Script-JS.Trojan.Egairtigado
Status:
Malicious
First seen:
2026-07-10 09:12:25 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
14 of 36 (38.89%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xworm discovery execution rat trojan
Behaviour
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks computer location settings
Executes dropped EXE
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
45.88.91.35:7004
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
XWorm
rar 670063d3c24ab6645205ede5d31c9ceaeefccdf0e3f0be21cdc46fb44ed69a01
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.