MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfcf3a2131607f0eda3b586bfc88b7fca5544833bd2faa3f3c4d64bd88b3285b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cfcf3a2131607f0eda3b586bfc88b7fca5544833bd2faa3f3c4d64bd88b3285b
SHA3-384 hash:	4397fc5e7d20c0859dd5b00760ece3b33ceeb619b2916009aeecc04d317490375900b1d353708165328deda0602f7246
SHA1 hash:	3b6f0a38464561a0927dfd5e199003136a551b4c
MD5 hash:	97c7636528d2445b88771cb9274a6b77
humanhash:	eight-victor-mississippi-timing
File name:	Ziraat Bankası Swift Mesajı9-11-2026.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	2'947'379 bytes
First seen:	2026-11-09 10:15:35 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	49152:R4ogD6Kdr7Xlpo2ps/7VcC57K/aGVSanMEp5WmS0fFEp68KH5OYPUrs79GQFCg2Z:R4ogD6Kdr7XlO2ps/7VcC5e/aGsaMEpE
TLSH	T1B6D5542FC6688E29389F3BCC3D51E5F7D68FA74980549EE379E1E192E3250914CE3261
Magika	c
Reporter	abuse_ch
Tags:	geo js TUR xworm ZiraatBank

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

162

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress

Gathering data

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Creating synchronization primitives

Deleting a recently created file

Creating a process with a hidden window

Connection attempt

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Creating a process from a recently created file

Enabling autorun

Hybrid Analysis JS/TrojanDropper.ModiLoader

Verdict:

Suspicious

Labled as:

JS/TrojanDropper.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/cfcf3a2131607f0eda3b586bfc88b7fca5544833bd2faa3f3c4d64bd88b3285b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Link:

https://opentip.kaspersky.com/cfcf3a2131607f0eda3b586bfc88b7fca5544833bd2faa3f3c4d64bd88b3285b/results?tab=lookup

Joe Sandbox DonutLoader, XWorm

Result

Threat name:

DonutLoader, XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2001571

Signature

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Found malware configuration

JavaScript file contains suspicious strings

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suricata IDS alerts for network traffic

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected DonutLoader

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/97c7636528d2445b88771cb9274a6b77

CERT.PL MWDB xworm

Detection:

xworm

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/cfcf3a2131607f0eda3b586bfc88b7fca5544833bd2faa3f3c4d64bd88b3285b/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z7htuijrmb7q5wr3lbv7zcfx7ssvisbtxux2upz4jvsl3cftfbnq._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:xworm defense_evasion discovery execution loader persistence ransomware rat trojan

Link:

https://tria.ge/reports/261109-matp5syxgx/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Enumerates video capture drivers

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Registers new Windows logon scripts automatically executed at logon.

Detect Xworm Payload

Detects DonutLoader

Family: DonutLoader

Family: Xworm

Malware Config

C2 Extraction:

91.210.109.228:7004

VirusSign modiloader

Malware Family:

modiloader

Alert

Create hunting rule

Malicious:

True

Tags:

javascript

Link:

https://intel.virussign.com/intelligence/file/cfcf3a2131607f0eda3b586bfc88b7fca5544833bd2faa3f3c4d64bd88b3285b

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cfcf3a2131607f0eda3b586bfc88b7fca5544833bd2faa3f3c4d64bd88b3285b