MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aef9e1dd0fcc98ac553536e7492c321ee2b7b246bcb1956dc108e595cfff9ab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	aef9e1dd0fcc98ac553536e7492c321ee2b7b246bcb1956dc108e595cfff9ab2
SHA3-384 hash:	dbdd4c67763faef80143bbdb9726dbc0798e60aadc49ddb0ecbc3debd1b62cb90e2a985f739fa7f3d0ddb011967f955b
SHA1 hash:	081f924339c25bc029ac683991a9e272e5435d43
MD5 hash:	628204c16b6d5e58140b514d4eb63e14
humanhash:	nineteen-wisconsin-glucose-october
File name:	format js.rar
Download:	download sample
File size:	3'614 bytes
First seen:	2025-11-23 13:06:04 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	96:ZS02l3aJZDxPogTnhw9DI57a7lpSfsuFZIjNIV3+hatW:4qog7iNI57qDS1SrhatW
TLSH	T1D0713CAAB8A813D451311C45331E2DA5BD3C622DE6C7B4E0D40BB9CC91DF6A04FBC569
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	key
Tags:	rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

3

Origin country :

ID

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	format js.js
File size:	8'797 bytes
SHA256 hash:	61a285b25e9263ad4969c6626a8b9f93d12ec8bdcd8c7ed0e803e592133b448b
MD5 hash:	33f75454ee0a8f0733788f0ba9af26c9
MIME type:	text/plain

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=691aff94434cd67b17c26e16

Tags:

downloader dropper virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated remcos repaired

Link:

https://www.filescan.io/uploads/69233501eecb08e4aa45e939/reports/bc1ce5df-3b85-43ca-aa0e-e5b4df82d66b/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/aef9e1dd0fcc98ac553536e7492c321ee2b7b246bcb1956dc108e595cfff9ab2

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2025-11-22T12:09:00Z UTC

Last seen:

2025-11-22T12:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/aef9e1dd0fcc98ac553536e7492c321ee2b7b246bcb1956dc108e595cfff9ab2/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/628204c16b6d5e58140b514d4eb63e14

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aef9e1dd0fcc98ac553536e7492c321ee2b7b246bcb1956dc108e595cfff9ab2/

ReversingLabs TitaniumCloud Script-JS.Downloader.Remcos

Threat name:

Script-JS.Downloader.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-22 06:02:55 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

15 of 36 (41.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v346dxipzsmkyvjvg3tuslbsd3rlpmsgxsyzk3obbdszlt77tkza._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/251123-vksjtsar2z/

Behaviour

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/aef9e1dd0fcc98ac553536e7492c321ee2b7b246bcb1956dc108e595cfff9ab2