🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc46e3be61a09d84be8c07fa13172c858cf435962a00aae5dce12480e5590403. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Xw


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc46e3be61a09d84be8c07fa13172c858cf435962a00aae5dce12480e5590403
SHA3-384 hash: fa33363a02abd49ea80360ba29f203e3123a6f5eba8f23267aaba7b81d54d01b82d346e4764e718aebdb622298b24fef
SHA1 hash: 350e6d5dcfcf81b95df6fa7de3565fbfe288fc4b
MD5 hash: e9bd8602ee6455e0ca6a6fd8738d2460
humanhash: avocado-illinois-sad-carpet
File name:PAGO F-7059.js
Download: download sample
Signature Xw
Create hunting rule
File size:211'837 bytes
First seen:2026-10-05 09:41:13 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:tozvfYHHVLdFPtiNPFoTSlPHVCVt7jxmceygO8PE14P/1wIMfCk14Mg3bkpq/ZXC:XIVpvmY6lB
TLSH T12A240052038917BDF68E0ED88A5B240720F1D4177D289248BFBF6AE7BF3B9845434A75
TrID 57.1% (.S) Digital Micrograph Script (4000/1/1)
42.8% (.TRA) Infinity Engine Translation (with rem) (3001/2/1)
Magika javascript
Reporter lowmal3
Tags:js xw

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm encrypted evasive fingerprint lolbin obfuscated obfuscated persistence regasm repaired schtasks
Link:
https://www.filescan.io/uploads/6ac370bdf549c36c8c27c2ad/reports/b4711789-75ec-4ae3-9153-4fcfb7929340/overview
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/cc46e3be61a09d84be8c07fa13172c858cf435962a00aae5dce12480e5590403
Verdict:
Malicious
File Type:
js
First seen:
2026-10-02T16:03:00Z UTC
Last seen:
2026-10-07T06:07:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/cc46e3be61a09d84be8c07fa13172c858cf435962a00aae5dce12480e5590403/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1982293
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Found malware configuration
Injects a PE file into a foreign processes
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1982293 Sample: PAGO F-7059.js Startdate: 05/10/2026 Architecture: WINDOWS Score: 100 43 ogo1.duckdns.org 2->43 45 pki-goog.l.google.com 2->45 47 c.pki.goog 2->47 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for URL or domain 2->63 67 15 other signatures 2->67 9 wscript.exe 1 6 2->9         started        13 wscript.exe 2 2->13         started        signatures3 65 Uses dynamic DNS services 43->65 process4 file5 37 C:\Users\user\AppData\...\DeviceCatalog.js, ASCII 9->37 dropped 69 JScript performs obfuscated calls to suspicious functions 9->69 71 Suspicious powershell command line found 9->71 73 Wscript starts Powershell (via cmd or directly) 9->73 77 4 other signatures 9->77 15 powershell.exe 20 9->15         started        19 schtasks.exe 1 9->19         started        75 WScript reads language and country specific registry keys (likely country aware script) 13->75 21 schtasks.exe 1 13->21         started        signatures6 process7 file8 41 C:\Users\user\AppData\...\yqiv5vy0.cmdline, Unicode 15->41 dropped 51 Writes to foreign memory regions 15->51 53 Allocates memory in foreign processes 15->53 55 Suspicious execution chain found 15->55 57 Injects a PE file into a foreign processes 15->57 23 RegAsm.exe 2 15->23         started        26 csc.exe 3 15->26         started        29 conhost.exe 15->29         started        31 conhost.exe 19->31         started        33 conhost.exe 21->33         started        signatures9 process10 dnsIp11 49 ogo1.duckdns.org 153.52.182.94, 3567, 49724, 49725 CTA-42-AS1226-CaliforniaDepartmentofTechnologyUS United States 23->49 39 C:\Users\user\AppData\Local\...\yqiv5vy0.dll, PE32 26->39 dropped 35 cvtres.exe 1 26->35         started        file12 process13
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc46e3be61a09d84be8c07fa13172c858cf435962a00aae5dce12480e5590403/
Threat name:
Script-JS.Trojan.Cryxos
Create hunting rule
Status:
Malicious
First seen:
2026-10-02 22:14:13 UTC
File Type:
Text (JavaScript)
AV detection:
11 of 38 (28.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrdohptbucoyjpuma75bgfzmqwgpinmwfiakvzo44esibzkzaqbq._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence rat trojan
Link:
https://tria.ge/reports/261005-lnw7razaqa/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Enumerates connected drives
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Process spawned unexpected child process
Malware Config
C2 Extraction:
ogo1.duckdns.org:3567
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc46e3be61a09d84be8c07fa13172c858cf435962a00aae5dce12480e5590403

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_0507f067_Script
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat script)
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments