03teste.com: a domain that URLhaus lists for XWorm text files, and what to do if a script on your PC fetched them

What 03teste.com is, and what we know about it

03teste.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where files tagged with the malware name XWorm were served. We found no public write-up of this one address, so what follows is what URLhaus shows, what our own check found, and what security researchers have published about XWorm and about the way such text files are used.

1. 1

   What URLhaus lists

   Four file addresses on 03teste.com, all in a folder called Margarina and all ending in .txt: By.txt, T03.txt, T02.txt and T01.txt. They were added within two minutes of each other on 21 September 2026, from 07:22:12 to 07:24:07 UTC. All four carry the threat label malware_download, the reporter is abuse_ch, and all four are marked offline.

2. 2

   What the tags mean

   xworm is the name of a remote access trojan, a program that lets a stranger control a computer. ascii means the file is plain readable text rather than a program. A plain text file tagged with a malware name is usually not the trojan itself but the code that a script downloads and runs to install it. That is our reading of the tags together with the published patterns below, not something URLhaus states.

3. 3

   What we could not confirm

   We did not download any of the four files, so we cannot tell you what is inside them, which XWorm build they lead to or where it reports to. The files are offline now, so nobody can check them today. We also do not know which message, document or program makes a victim's PC ask for these files. That first step is not visible from the server side.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these files in the window when they were online. A normal visitor has no reason to ask for them.

Kind of threat

A domain that served four text files tagged xworm and ascii, the name of a remote access trojan for Windows

Where the files were

hxxps://03teste[.]com/Margarina/T01.txt, T02.txt, T03.txt and By.txt (secure web address, normal port)

Domain registered

11 September 2026, ten days before the reports, registrar NameSilo, LLC; the status is client hold and client transfer prohibited (RDAP, read 17 October 2026)

URLhaus entries

4 file addresses, all added on 21 September 2026; all 4 offline in our copy of the data

Delivery trick

Code kept in a plain text file so the download looks harmless. The step that makes a PC ask for it is not known

Platform

Windows. XWorm is described as a Windows .NET program in the reports we read. Nothing we read says these files affect Mac, iPhone or Android

What we checked on 17 October 2026, and what we could not

Our check was a plain request from our server to the address on 17 October 2026. It failed before any page could load: the name 03teste.com was not found (error ENOTFOUND). That clears nothing. It only says the name does not lead anywhere today.

What happened to 03teste.com, from registration to our check

The domain is very young: it was registered ten days before the first report. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 11 September 2026

   The domain is registered

   RDAP shows 03teste.com registered on 11 September 2026 through NameSilo, LLC. A domain that is only days old when it starts serving malware is a common pattern, but it is not proof of anything by itself.

2. 21 September 2026

   Four text files are reported within two minutes

   abuse.ch adds By.txt at 07:22:12, T03.txt at 07:22:13, T02.txt at 07:23:12 and T01.txt at 07:24:07 UTC. All four sit in the folder /Margarina/ and carry the tags ascii and xworm. The status is already offline in our copy of the data.

   

3. 17 October 2026

   RDAP and our request

   RDAP lists the status client hold and client transfer prohibited. Our server cannot find the name 03teste.com. We do not know when the name stopped working, only that it does not work on this date.

What the pattern suggests, and what it does not: four files with numbered names (T01, T02, T03) and one extra (By) all added by the same reporter within two minutes looks like one batch of files found on one server, not four separate events. The folder name Margarina and the word teste (Portuguese for test) may hint at the operator's language, but that is our reading of two words and we draw no conclusion from it.

How a plain text file can lead to a remote access trojan

A text file cannot hurt you by being opened or read. It works only when a script that is already running downloads the text, decodes it and starts what is inside. We did not see the four files on 03teste.com; this is how researchers and sandbox reports describe the pattern for XWorm.

1. 1

   A first program is already running

   A 2025 briefing from Cybanetix says XWorm is usually delivered through social engineering and phishing. It lists ZIP archives holding obfuscated script loaders, WSF, VBS, BAT and LNK droppers, and SVG files with embedded JavaScript. In each, the person opens something and a script starts.

2. 2

   The script asks a server for a text file

   Sandbox runs on ANY.RUN include XWorm-tagged samples that are plain ASCII text files with very long lines, flagged as a loader with suspicious PowerShell. That fits a single line of encoded PowerShell. The reports we saw give hashes and metadata but not the decoded commands, so we cannot confirm the exact logic for our four files.

3. 3

   The text is decoded and run in memory

   Red Sky Alliance, summing up an analysis by FortiGuard, describes an Excel attachment that fetches an HTA file, which starts PowerShell, which loads a .NET module that never touches the disk as a normal file. The module then puts XWorm into a new MSBuild.exe process. MSBuild.exe is a real Windows program, so in Task Manager the process carries a trusted name.

4. 4

   XWorm connects to its controller

   Red Sky Alliance and the other write-ups describe XWorm as a remote access trojan sold as malware as a service since 2022. From then on a person elsewhere may use the PC. What that person does depends on the build and the buyer, and for 03teste.com we do not know either.

The useful defences are earlier and later than the text file: do not run the first program, and notice the trojan and its connection afterwards. A filter that only judges the file type sees a harmless .txt, which is why this trick is used.

What XWorm is, and what the sources we read say about it

XWorm is a remote access trojan, in short a RAT. We read only a few pages about it for this guide, so the table below is short on purpose, and it says where we have no source.

What this can cost you

Reading the site name or seeing it in a log costs nothing. The risks below apply to a Windows PC where a script fetched one of these files and XWorm then ran. We describe what a remote access trojan makes possible in general; we did not confirm each item for XWorm.

• High

  Passwords and accounts

  If a program logs what you type, it records new passwords too. Changing passwords from the infected PC does not help, because a watcher sees the new ones.

• High

  Someone using your PC live

  A remote access trojan is not a one off theft. The controller may come back at any time and act while you are logged in.

• High

  Crypto and banking

  Crypto sent from a stolen wallet cannot be reversed. A bank session opened on a watched PC can be watched too.

• Medium

  Your files

  Documents and photos on a PC under remote control may be copied. Whether XWorm did that here is not known.

• Medium

  More malware on the same PC

  Loaders that bring one family often bring others. Check the whole PC, not only the one process.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Remote access trojans are built to be quiet. The signs below come from the sources and from what they imply; none is certain, and many victims notice nothing.

How a person ends up asking for these files

Nobody visits 03teste.com/Margarina/T01.txt on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server; the routes below are the ones the reports we read describe for XWorm.

1. 1

   An archive with a script inside

   Cybanetix describes ZIP files that hold obfuscated script loaders, and WSF, VBS, BAT or LNK files that start them. Double-clicking the script is what starts the download.

2. 2

   An Office attachment

   Red Sky Alliance describes an Excel file that fetches an HTA file and then PowerShell. Opening the file and allowing what it asks for is the step that matters.

3. 3

   A picture file with JavaScript

   Cybanetix also names SVG files with embedded JavaScript. An SVG looks like an image but can carry a script that a browser runs.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact 03teste.com, or did you open an unexpected attachment, archive, script or installer around 21 September 2026 or earlier? If you saw the name in a firewall or DNS log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

Because the files are offline, a PC that asks for them today gets nothing. A request in a log from after late September is probably a leftover script that still tries, which is itself a sign that the script is on that PC.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A remote access trojan needs the connection to be used.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Open Task Manager

   Press Ctrl + Shift + Esc and look at the Processes tab for MSBuild.exe or powershell.exe running with no reason, or any process with high network use. Right-click a process and choose Open file location to see where it lives. Presence is not proof and absence does not clear the PC.

4. 4

   Look at Startup apps and Task Scheduler

   Open Settings > Apps > Startup and look for names you did not install. Then press Start, type Task Scheduler and look in Task Scheduler Library for tasks you do not know, with random names, or that run a script from a user folder. Write down the name and what it runs; do not delete yet.

5. 5

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for a detection that names XWorm, a PowerShell script or a loader, or for anything blocked or quarantined near the time of first contact. Microsoft says the results of an offline scan also appear there.

6. 6

   Check Defender exclusions

   In Windows Security > Virus & threat protection > Manage settings > Exclusions, look for folders you did not add. Malware sometimes asks for exclusions so it is not scanned. We found no source saying XWorm does this, so a clean list does not clear the PC.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.

8. 8

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result as one data point, the same way as a quiet site test. No vendor publishes a removal procedure for this server's files and we infected no PC, so the plan below is our judgement from Microsoft's page, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags and every source we read describe a Windows threat. We found nothing that says the files on 03teste.com affect anything else.