MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a919978948479db076de3d31d76ba77dd22d4fde51fe1100e93ecd24c1fa5c3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a919978948479db076de3d31d76ba77dd22d4fde51fe1100e93ecd24c1fa5c3c
SHA3-384 hash:	6400a7e27a6cb721d2c0f071bd0cc074f0c2aa05e9d74439b11bb893b55ad379cb48fb455e6e65e3b5e84382c44e4fb6
SHA1 hash:	f7a3feb2d29c6f73873b2027730e0dc7bf69eeeb
MD5 hash:	dbd859f8238410663f69c1a492c076f9
humanhash:	mirror-seven-spaghetti-ink
File name:	a919978948479db076de3d31d76ba77dd22d4fde51fe1100e93ecd24c1fa5c3c.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	8'789'570 bytes
First seen:	2026-05-11 07:13:07 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	196608:UKsXWADFZoAxECbhfsItFWXAdCxjavHkOFjHqsiPy9W33UjO51ea4IQBqOX6FJ1/:UKQWqFZDx3s61wuvvKSBufrrPk/n3g+Y
TLSH	T106968E08915D96EF25B9BF05A07D82C23E4E32FFDE35D709600EC4B5A24E9933A9714E
Magika	javascript
Reporter	JAMESWT_WT
Tags:	js Orio-Xrio xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

146

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a01dd77059cfdadce20d5b6

Tags:

infosteal autorun

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 base64 crypto evasive formbook lolbin obfuscated obfuscated persistence powershell privilege reconnaissance repaired schtasks zusy

Link:

https://www.filescan.io/uploads/6a0181e52fcb905ec28ccb7a/reports/bea54a34-6421-4e42-96b5-3ab0fb0dd0da/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a919978948479db076de3d31d76ba77dd22d4fde51fe1100e93ecd24c1fa5c3c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-05-07T10:04:00Z UTC

Last seen:

2026-05-13T04:38:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/a919978948479db076de3d31d76ba77dd22d4fde51fe1100e93ecd24c1fa5c3c/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a919978948479db076de3d31d76ba77dd22d4fde51fe1100e93ecd24c1fa5c3c/

Neiki Trojan.JS.SAgent

Verdict:

Malicious

Threat:

Trojan.JS.SAgent

Link:

https://tip.neiki.dev/file/a919978948479db076de3d31d76ba77dd22d4fde51fe1100e93ecd24c1fa5c3c

ReversingLabs TitaniumCloud Script-JS.Trojan.Generic

Threat name:

Script-JS.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-05-07 18:16:01 UTC

File Type:

Binary

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vemzpckii6o3a5w6huy5o25hpxjc2t66kh7bcahjh3gsjqp2lq6a._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution persistence rat trojan

Link:

https://tria.ge/reports/260511-h2lfmaf18p/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Detect Xworm Payload

Family: Xworm

Malware Config

C2 Extraction:

192.3.171.227:8823
50sOM3TQLDrExLbJ+Vugeg==:23

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a919978948479db076de3d31d76ba77dd22d4fde51fe1100e93ecd24c1fa5c3c