MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1e3cc9b1f0231dbb7c9180efc6b4ae3da74626a0de319289ffc9b6cf3479eae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e1e3cc9b1f0231dbb7c9180efc6b4ae3da74626a0de319289ffc9b6cf3479eae
SHA3-384 hash:	7858c82ff7353a1b8ba45c987754b66a75a1fc05ffcfe9379e26b4f83c79ed6d1de219b838c6724c1a2398100bdd03a7
SHA1 hash:	a9e42799b06a15f0166598ce9fcae09e695dcee4
MD5 hash:	7b6d538972f08950f0745fae5619f4ff
humanhash:	ohio-green-lima-bacon
File name:	RFQXforXSupplyXofXPipe,XFlangesXXXFittings.rar
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	800'864 bytes
First seen:	2026-07-24 12:15:29 UTC
Last seen:	2026-07-24 12:39:06 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:SbuVEaEyPsll11fSes+d0Gp/yr8FIMNcQRpin8x:SkEByUll19Ses+c8FIMNrZx
TLSH	T14205234F92ECA560EE7218FB23EA85066F806726F5743005E31E013FEE2653C7966B5D
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar xworm

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

40

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	RFQ SPECIFICATIONS.JS
File size:	2'538'183 bytes
SHA256 hash:	297c42b80a5a55d2a108e01d14d18ce77ea7f4a189b16b985da61190b857872b
MD5 hash:	a9c16e879bc90687e891df907ff332e3
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c8f112f9-7d27-41b2-89b8-50db45ff18cd/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a6357d66e2d72c6b55a41da/reports/0b58a50e-2378-49dc-9788-602010c0661c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e1e3cc9b1f0231dbb7c9180efc6b4ae3da74626a0de319289ffc9b6cf3479eae

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-13T02:26:00Z UTC

Last seen:

2026-07-17T22:56:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e1e3cc9b1f0231dbb7c9180efc6b4ae3da74626a0de319289ffc9b6cf3479eae/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/7b6d538972f08950f0745fae5619f4ff

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e1e3cc9b1f0231dbb7c9180efc6b4ae3da74626a0de319289ffc9b6cf3479eae/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-13 05:04:29 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

13 of 36 (36.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4hr4zgy7aiy5xn6jdahpy22k4pnhiytkbxrrske77snwz42ht2xa._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:xworm execution loader persistence rat trojan

Link:

https://tria.ge/reports/260724-p3wrbaem4t/

Behaviour

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Checks computer location settings

Executes dropped EXE

Detect Xworm Payload

Detects DonutLoader

Family: DonutLoader

Family: Xworm

Malware Config

C2 Extraction:

104.239.66.185:7004

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/e1e3cc9b1f0231dbb7c9180efc6b4ae3da74626a0de319289ffc9b6cf3479eae