MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 866cb294cb004d4a3e8fee3a30d262dc46b06fc4e3725314eb6bce87c9221875. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	866cb294cb004d4a3e8fee3a30d262dc46b06fc4e3725314eb6bce87c9221875
SHA3-384 hash:	413050b4475797680090fa1e4016e39f226d323bb7dbf34b6a130ace9924f3fd36cca87624e2fe643afaa9c0952ab80f
SHA1 hash:	fbb5579e433e37be489bc9237fa6e32d2afd732c
MD5 hash:	721696994f6ab4a05620c209158f0ef7
humanhash:	ack-echo-minnesota-freddie
File name:	MadinaX-XPROJECTXSPECIFICATION.rar
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	1'249'209 bytes
First seen:	2026-06-12 21:53:31 UTC
Last seen:	2026-06-12 21:54:31 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:l8SCJqRWfKKUK2pfxh9o3RRavdNkQ1K3VNW8xghPhBn2vB4:lxCEGCVTgkvdawK31xg9hBnO6
TLSH	T129453371F1211C30E9289BF78A3F94A9F3A72A7E5A9B9FD781301186141701F9B9DE81
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar xworm

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

72

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Madina - PROJECT SPECIFICATIONS.JS
File size:	6'609'631 bytes
SHA256 hash:	d15248555e7a2d9c279d219e6587a74fca9c25720194512a2e4b0757f7a63219
MD5 hash:	042db31ea5443d78aeee714556813a28
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d62c0cd0-b2e9-402e-af22-0682f91f66a3/

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2c802334eaf30d8ce55382

Tags:

virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a2c80268161ac6cb55fee99/reports/7f93b616-778c-4065-9079-f13cc342cdb3/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/866cb294cb004d4a3e8fee3a30d262dc46b06fc4e3725314eb6bce87c9221875

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-09T22:41:00Z UTC

Last seen:

2026-06-09T22:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/866cb294cb004d4a3e8fee3a30d262dc46b06fc4e3725314eb6bce87c9221875/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/866cb294cb004d4a3e8fee3a30d262dc46b06fc4e3725314eb6bce87c9221875/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-10 03:37:23 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qzwlffglabguupup5y5dbutc3rdla36e4nzfgfhlnphipsjcdb2q._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/866cb294cb004d4a3e8fee3a30d262dc46b06fc4e3725314eb6bce87c9221875