MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b26eea4780752a710cfec690a4ee7e2f6867c89a3e0848edd31a6998ab63463b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b26eea4780752a710cfec690a4ee7e2f6867c89a3e0848edd31a6998ab63463b
SHA3-384 hash:	3ae861c02f7ccb596ec9a01c6ffbf73852fa4c6fc2987e9ae95601e475761b9b598f589459b325c1afb36f6b06bee4b7
SHA1 hash:	ff769876f08dd90595be48656be0b0e8765c701c
MD5 hash:	2201a4c5bf18d3c3b4624c46ed26a759
humanhash:	three-salami-solar-mississippi
File name:	nBank_Details_Confirmation_and_invoice.tar
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	9'855 bytes
First seen:	2026-08-11 06:00:21 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-rar
ssdeep	192:Zgjxi0vflMWBW+2rCCQsvJxG7Mnf1Zdt2zvuBpuah3ZUwBgGCpe4fJytDNT1CEo0:Zgjxrl3IrCC/JQ7Kr2Luqk1Bg8wytt17
TLSH	T17B12AFC5001580F4E5F816A1E2737A5E6A770CA2214F2BC7760A7597F62C87D8B6B883
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	FXOLabs
Tags:	tar xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

55

Origin country :

US

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/1d8107e1-03a8-41d6-943b-79df604cf82e/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Starter.505.18298.31768.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Rogue.0hr.20260811-1232.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b26eea4780752a710cfec690a4ee7e2f6867c89a3e0848edd31a6998ab63463b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-08-11T04:34:00Z UTC

Last seen:

2026-08-11T21:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b26eea4780752a710cfec690a4ee7e2f6867c89a3e0848edd31a6998ab63463b/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b26eea4780752a710cfec690a4ee7e2f6867c89a3e0848edd31a6998ab63463b/

ReversingLabs TitaniumCloud Win32.Trojan.Kepavll

Threat name:

Win32.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-11 04:22:51 UTC

AV detection:

10 of 23 (43.48%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wjxour4aouvhcdh6y2ikj3t6f5ugpse2hyeer3otdjuzrk3diy5q._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution persistence privilege_escalation rat trojan

Link:

https://tria.ge/reports/260811-gz8mpstvex/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Creates a file in the Startup directory

Executes dropped EXE

Badlisted process makes network request

Detect Xworm Payload

Family: Xworm

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://64.224.17.122/pinmsi.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b26eea4780752a710cfec690a4ee7e2f6867c89a3e0848edd31a6998ab63463b