tronzadorasnng.com: a Windows XWorm malware site that hides code in PNG pictures, and what to do if a script from it ran

What tronzadorasnng.com is, and what we know about it

tronzadorasnng.com is a web address, not a program on your PC. It is a domain that the abuse.ch project URLhaus lists as a place where malware was served, and all seven of its entries carry the tag xworm. No public write-up of this one domain exists that we could find, so this page rests on what URLhaus shows, what we saw ourselves and what AhnLab has published about XWorm delivered through pictures.

1. 1

   What URLhaus lists

   Seven file addresses on tronzadorasnng.com, all added on 9 October 2026 by the abuse.ch reporter account between 18:34 and 18:38 UTC. Four are plain addresses with random eight-character names and the tags ascii, Encoded and xworm: SzvAZo0M, Q196T8Mz, 07J45QiL and 3PNXr9P2. Three are PNG pictures with the tags stego and xworm: img_010548.png, img_005350.png and img_002333.png. All seven carry the threat type malware_download and were offline when we read them.

2. 2

   What the tags mean

   xworm names the malware family: XWorm is a remote access tool, a program that lets another person control a PC. stego says that the PNG picture hides data inside it. ascii says the other files are plain text, not compiled programs, and Encoded says the reporter saw that text in an encoded form. Together they describe text files and pictures that a script combines to rebuild a program.

3. 3

   What we could not confirm

   We did not download any of the files and we never saw a page that tells visitors what to do. So we do not know how a victim reached the files, what exactly each picture holds, or how the four text files differ. The tags are the reporter's labels, not our finding.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, you are not infected by that alone. The risk is for people who opened a script file that reached out to this address, pasted a command that did, or ran a file that came from it.

Kind of threat

A malware download address; all seven entries are tagged xworm, three of them PNG pictures tagged stego

Malware family

XWorm, a remote access tool for Windows (reporter's tag, not confirmed by us)

Domain registered

16 August 2026, expires 16 August 2027, registrar NameSilo, LLC; record last changed 8 October 2026 (RDAP, read 10 October 2026)

URLhaus entries

7 file addresses, all added on 9 October 2026 within four minutes; all 7 offline when we read them

Platform

Windows, by the xworm tag and the PowerShell style of the chain. No source says which other systems are hit

What we checked on 10 October 2026, and what we could not

We opened https://tronzadorasnng.com/ one time from Lithuania with an automated Chromium set to English. The browser could not find the name, so there was no page to look at. A missing page says nothing good about the owner, and it proves nothing about safety either.

What happened to tronzadorasnng.com, from registration to our test

The history is short: the domain is under two months old and all seven malware addresses were reported within four minutes of each other. The dates come from RDAP and from the URLhaus database.

1. 16 August 2026

   The domain is registered

   RDAP shows tronzadorasnng.com registered on 16 August 2026 through the registrar NameSilo, LLC, valid until 16 August 2027. The name reads like Spanish for a cutting machine maker with a short ending; nothing we found shows a real business behind it.

2. 8 October 2026

   The registration record changes

   RDAP shows the record last changed on 8 October 2026, the day before the first malware reports. We do not know what was changed or why.

3. 9 October 2026, 18:34 UTC

   The first files are reported

   URLhaus receives a text file, SzvAZo0M, and a picture, img_010548.png, both tagged xworm. This is the first time URLhaus sees the host.

   

4. 9 October 2026, 18:37 to 18:38 UTC

   Five more files follow

   Within about four minutes the reporter adds two more text files, Q196T8Mz and 07J45QiL, then a picture, img_005350.png, then a fourth text file, 3PNXr9P2, and a third picture, img_002333.png. The pattern looks like one batch of files collected from the same server.

5. 10 October 2026

   Our test finds no address

   Our browser visit to https://tronzadorasnng.com/ ends in ERR_NAME_NOT_RESOLVED, and URLhaus shows all seven files offline.

We could not read the URLhaus pages themselves, because they ask for a browser check. The entries above come from the same data in our own database, which holds the URLhaus feed.

How malware can hide in a picture, and what XWorm is

We did not see what tronzadorasnng.com's pictures hold. This is how AhnLab describes the same method in another XWorm campaign, so you can recognise the pattern.

1. 1

   A script file starts the chain

   AhnLab's analysis says a phishing email delivers a VBScript or JavaScript file. The first script adds an embedded PowerShell script that holds Base64 text mixed with dummy characters. The PowerShell removes the dummy characters with Replace(), decodes the rest and runs it.

2. 2

   PowerShell fetches a picture

   That PowerShell downloads a JPG image from an outside server. The image opens as a normal picture, so a person who looked at it would see nothing wrong.

3. 3

   The program is read out of the picture data

   AhnLab describes two versions. In the older one, Base64 text sat between the markers <<BASE64_START>> and <<BASE64_END>>. In the newer one, the script finds a bitmap signature at the end of the JPG and reads the red, green and blue values of its pixels to rebuild a .NET loader.

4. 4

   The loader starts XWorm

   The rebuilt loader runs and starts the final malware, XwormRAT. AhnLab says the files it names in that campaign were hosted on services such as archive.org, an r2.dev address and paste.ee. That shows attackers mix picture files and text files from different places, which fits the mix of text and picture files URLhaus lists here, though we cannot say that the two campaigns are linked.

The point of the trick is that no ordinary installer file ever lands on the disk, and a PNG or JPG looks harmless to a quick filter. It does not mean the picture on your screen is dangerous to view. The danger is the script that reads the picture and runs what it finds.

XWorm itself is a remote access tool. That is a program that connects out to a server run by the attacker and then takes orders, which is why this page tells you to disconnect the PC before anything else. We did not analyse a sample, and we found no first-hand analysis of the tronzadorasnng.com files, so we do not list its commands or settings here.

The seven files: what each name suggests, and what we do not know

File names are weak evidence. We list what each group could be and mark which statements are only a reading of the names and tags.

Three pictures with numbered names and four text files with random names suggest a server that offers several variants, perhaps one set for each target or each day. That is a habit we can guess at, not something we saw. We did not fetch the files, so we cannot say how the seven belong together.

What a remote access tool like XWorm can mean for you

We did not open the files and found no analysis of them, so we cannot list what this copy does. The table below is the general meaning of a remote access tool, not a claim about this site's files.

What this can cost you

Reading the site name or seeing a warning costs nothing. The risks below apply to a PC where a script from the site ran or a file from it was opened.

• High

  A stranger at the controls

  A running XWorm lets someone reach the PC over the internet. Pull the network cable or turn off Wi-Fi before anything else, even before you touch a password.

• High

  Logins, cookies and saved data

  Whatever you type or keep in the browser can be read by a remote tool. Reset passwords on a different device and use each service's sign out everywhere option, since a fresh password may not cancel a session that was already copied.

• High

  Wallets and recovery phrases

  Treat any crypto wallet on that PC as exposed. Transfers cannot be undone, so create a new wallet on a clean device and move the funds first.

• Medium

  A copy that survives a restart

  We found no source that describes how this chain keeps itself alive. Until an offline scan has run, or Windows has been reinstalled, assume the PC may call home again after it boots.

• Medium

  Employer systems

  A work laptop holds logins to company tools. Call your IT or security contact immediately so they can lock those accounts.

• Low

  Little or nothing for a name seen in passing

  Meeting the domain name in a log, a mail filter report or a blocked link does not mean anything was installed.

What you may notice, and what you may not

Many victims notice nothing. The signs below follow from how these chains are built; the first is the best evidence you have.

How people end up running a script like this

No source tells us how people reached tronzadorasnng.com. AhnLab names one route for this picture technique in general, a mail that carries a script.

1. 1

   A mail with a script attached

   AhnLab says the chain starts with a phishing mail carrying a VBScript or JavaScript file. ANY.RUN describes a comparable XWorm dropper named like a purchase order, PurchaseOrder_25005092.js, that writes its parts to C:\Users\PUBLIC. Windows treats a .js or .vbs file as a program, so opening it runs it.

2. 2

   A command a page asks you to paste

   Some pages tell you to paste a line into the Run box or PowerShell to pass a check. Extensionless text files fetched by one short command would fit that start, but no source says this site did it, and we never saw its page.

3. 3

   A fake update or free program

   Cracked programs and fake updates often carry remote tools. That is general background, not something we saw here.

4. 4

   A link in a message

   A link in chat, mail or a comment can lead to a script download. We have no evidence of how this domain was shared.

Check your Windows PC before you delete anything

Begin with one question: did you open a script, paste a command that pulled something from tronzadorasnng.com, or start a file that came from it? If so, go straight to the numbered plan, because a tidy check does not clear a PC. If you are unsure, run the checks below first. None of them deletes a thing.

Until you know, keep the PC away from banking, email, work and crypto, and take it off Wi-Fi and cable if you can.

1. 1

   Identify what you actually ran

   Locate the file you double clicked, or recall the line you pasted. Write down its name and folder. If it came in an email, keep that message. Do not run it a second time.

2. 2

   Hunt for pictures that are not pictures

   In File Explorer open Downloads, C:\Users\Public and %TEMP%. Look for .png or .jpg files you never saved. A file that refuses to open in Photos should be noted by name and left in place for now.

3. 3

   Scan Task Scheduler for strangers

   Press the Windows key, type Task Scheduler and open it, then pick Task Scheduler Library. Read the name and the Actions tab of anything new or oddly named. Only record what you see.

4. 4

   Open the Startup folder

   Press Windows key + R, enter shell:startup and confirm. Anything you did not place there deserves a note.

5. 5

   Read your Run history after a pasted command

   Start Registry Editor (Windows key, regedit, Enter) and browse to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Each value is a line once typed in the Run box. Copy down any that mention powershell, a web address or tronzadorasnng, and never execute them.

6. 6

   Review Windows Security

   Go to Windows Security > Virus & threat protection > Protection history. On Windows 10 reach it through Settings > Update & Security > Windows Security. Look for alerts near the time the script ran.

7. 7

   Read a clean result with care

   This kind of chain works in memory and may leave almost nothing on disk, so a tidy report only reduces the doubt.

Scan from outside Windows: Microsoft Defender Offline

Microsoft Defender Offline starts a scan outside the running Windows session. Microsoft's page says it runs outside the normal Windows kernel and aims at malware that dodges the shell, such as rootkits, which makes hiding harder.

1. 1

   Get ready

   Save open work and close programs. Microsoft puts the run at about 15 minutes plus a restart. You need local administrator rights and Windows Recovery Environment switched on. Check it in an elevated Command Prompt with reagentc /info, and turn it on with reagentc /enable if it reads Disabled. Microsoft warns that with WinRE off the scan silently does nothing.

2. 2

   Pause BitLocker first

   If the system drive uses BitLocker, suspend protection beforehand, or the restart into the scan may ask for your recovery key.

3. 3

   Launch it

   In Windows Security pick Virus & threat protection, then Scan options, tick Microsoft Defender Offline scan and press Scan now. Accept the prompts. Windows signs you out, reboots into the scan and returns to the desktop when done. An elevated PowerShell does the same with Start-MpWDOScan.

4. 4

   Find the outcome

   Afterwards open Virus & threat protection > Scan options > Protection history. Microsoft notes the offline scan is not available on Windows on ARM, and that Defender Antivirus has to be your primary antivirus to get its updates.

5. 5

   Keep going even if it is empty

   An empty report cannot prove that a remote tool never ran. If a script from this site did run, finish with a document backup and a clean Windows install.

If you use a Mac, an iPhone or an Android phone

The xworm tag and the PowerShell style of the chain suggest Windows. Nothing we read says the seven files run elsewhere.