MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95
SHA3-384 hash:	c2071a8aa2bf316038dc6620cc2b58ec5ad483b04d0eabe70a979e9ad593f2275698265df35e2bdb94bb271f94488ded
SHA1 hash:	af3190712536a11f7fa8bdd2ec4615e13e95a762
MD5 hash:	6667dfe2ff34d6e78a7ec44167fdb96d
humanhash:	arkansas-happy-may-india
File name:	P0-678766887678.7z
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	14'292 bytes
First seen:	2026-02-24 07:05:06 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	384:POlL5bDllo7y4SDWagzbm5l4F01amFjKyGHh:2lL5bQ7thbmYFWamFdGB
TLSH	T13552D0D6E900AA72E07B922C3B3073CBE696CB7C6E9DAA533B148D8485F324555D1153
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	JAMESWT_WT
Tags:	7z xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

85

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	P0-678766887678.js
File size:	41'056 bytes
SHA256 hash:	0d2291b8f0b26d7cc0232e168776f4f8fb4d9565bbe73c76ec4330811d007ebd
MD5 hash:	d593069dc26679ed63869ed4b3d625f0
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.12782283.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699c9c7a8fffa866e3b13d68

Tags:

extens shell sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aspnet_compiler base64 evasive evasive lolbin obfuscated obfuscated reconnaissance repaired

Link:

https://www.filescan.io/uploads/699d4db997feb4afd65602a2/reports/23e73884-16dd-42fd-b35f-e1d5939ad5d2/overview

Hybrid Analysis Mal/Drod7zip

Verdict:

Suspicious

Labled as:

Mal/Drod7zip

Link:

https://www.hybrid-analysis.com/sample/a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

7z

Link:

https://opentip.kaspersky.com/a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95/

ReversingLabs TitaniumCloud Script-JS.Trojan.Egairtigado

Threat name:

Script-JS.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-23 20:39:04 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ub22duzktw5khxf6c3v3viyp2c67xn243pkwqtb2ayyttv56vokq._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution rat trojan

Link:

https://tria.ge/reports/260224-hz14ases4b/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Contacts third-party web service commonly abused for C2

Checks computer location settings

Badlisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a075a1d32a9dbaa3dcbe16ebbaa30fd0bdfbb75cdbd5684c3a063139d7beab95