MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebdff7225dab7aab8c0dd1c18516d8ce956ab4ff98f12cd8343ca770cab7b2a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ebdff7225dab7aab8c0dd1c18516d8ce956ab4ff98f12cd8343ca770cab7b2a8
SHA3-384 hash:	59735bfbdfd29c044195ed1f73943617f3adc63d6eacafad3d8ae663d8c9d6575fb74888daab6f09f994765eb24a5a94
SHA1 hash:	dd1f3addc56848dae07d456385d0ddfc3b2c55a7
MD5 hash:	b61f05563342a0ec5a22a986bf13d7a2
humanhash:	single-berlin-cold-red
File name:	pago.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	2'651'071 bytes
First seen:	2026-07-23 12:49:19 UTC
Last seen:	2026-07-23 13:23:55 UTC
File type:	js
MIME type:	text/plain
ssdeep	96:CjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjIjI+:ZuEfK+MF6L/x9kBQJdW1
TLSH	T1FFC5D9733EC2440EB25078916C58B502BBA525AF3E16BE4DB7F8A7D07101AAD150EDBF
Magika	javascript
Reporter	James_inthe_box
Tags:	exe js xworm

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

174

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fingerprint powershell repaired

Link:

https://www.filescan.io/uploads/6a620ddf4d78c28428e6e0df/reports/e1ae7960-c13d-4d80-823d-f1a7456a0756/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/ebdff7225dab7aab8c0dd1c18516d8ce956ab4ff98f12cd8343ca770cab7b2a8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-22T11:23:00Z UTC

Last seen:

2026-07-23T09:26:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/ebdff7225dab7aab8c0dd1c18516d8ce956ab4ff98f12cd8343ca770cab7b2a8/results?tab=lookup

Nucleon Malprob Susipicious

Score:

42%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/ebdff7225dab7aab8c0dd1c18516d8ce956ab4ff98f12cd8343ca770cab7b2a8

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ebdff7225dab7aab8c0dd1c18516d8ce956ab4ff98f12cd8343ca770cab7b2a8/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-23 00:56:56 UTC

File Type:

Binary

AV detection:

7 of 36 (19.44%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5pp7ois5vn5kxdan2haykfwyz2kwvnh7tdyszwbuhstxbsvxwkua._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution persistence rat trojan

Link:

https://tria.ge/reports/260723-p2ljysyhmg/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Badlisted process makes network request

Detect Xworm Payload

Family: Xworm

Process spawned unexpected child process

Malware Config

C2 Extraction:

64.89.162.178:7007

VMRay XWorm

Malware family:

XWorm

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ebdff7225dab/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/ebdff7225dab7aab8c0dd1c18516d8ce956ab4ff98f12cd8343ca770cab7b2a8