MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a238ce3926ecc848107778eebeb50850d928aea311845694334101aaa69b7fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8a238ce3926ecc848107778eebeb50850d928aea311845694334101aaa69b7fa
SHA3-384 hash:	d34db88d66bc76044a11911d335f42b7e2cb56c711dad8e567fb9d434aa48ccfe0f36a642764618579387c5815ebb891
SHA1 hash:	e657edbd91e119caa72b4e2a59a37903bf5eaa5e
MD5 hash:	a1a2f77708233c3ae0f7dca9a9a832a7
humanhash:	king-oxygen-wyoming-whiskey
File name:	PayXAdvice-0000121258.lzh
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	2'660 bytes
First seen:	2026-07-24 12:17:09 UTC
Last seen:	2026-07-24 12:38:21 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	48:/p08ZO/II1rEsqkOsd+dUr5Dy9B8Ij6deTOuJGmadBya:S8ZO/IbsdAr8IZsT5
TLSH	T1BF51058D0C82FD1FCE2C2BF4D77AE75D2C11B422ADA288A27B385533356587B80609C2
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar xworm

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

58

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Pay Advice-0000121258.js
File size:	1'719'961 bytes
SHA256 hash:	429db8441c18dc12f7c74262f4fe362e5c1f992008030f96896e8978e17a270e
MD5 hash:	e3f3f8097a1bbbdf6e0703773858fb12
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a788bcc9-3701-452b-afff-506c27e90283/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.DownLoader.10514.4788.13406.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8a238ce3926ecc848107778eebeb50850d928aea311845694334101aaa69b7fa

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-09T01:32:00Z UTC

Last seen:

2026-07-21T11:45:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8a238ce3926ecc848107778eebeb50850d928aea311845694334101aaa69b7fa/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8a238ce3926ecc848107778eebeb50850d928aea311845694334101aaa69b7fa/

ReversingLabs TitaniumCloud Win32.Trojan.Sonbokli

Threat name:

Win32.Trojan.Sonbokli

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-09 03:49:37 UTC

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260724-p4h7lsyzc1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/8a238ce3926ecc848107778eebeb50850d928aea311845694334101aaa69b7fa