MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f11239de0fc9d8cdf27c8f055f142facc2096bd30b9466e2d5e4b73b8d2bc01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2f11239de0fc9d8cdf27c8f055f142facc2096bd30b9466e2d5e4b73b8d2bc01
SHA3-384 hash:	d703fddf1d74e50db4ea4eb416321929e1b34032952bb6e6d7a719c843c43088f3ccb68f6b039a4c22a4b20a979dacac
SHA1 hash:	d54758ba61047d1e196819a195d597cda9e89cb6
MD5 hash:	fc54c25a867c3bbffe30672eaa3dabcd
humanhash:	mississippi-tennis-iowa-nineteen
File name:	RFQ_780236427.rar
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	7'444 bytes
First seen:	2026-06-02 15:47:16 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	192:OsW5VkzOwhY2FVluUVf1yjYGM3ZO+ZP1VMiQS:O3k1vNyXM3ZOgTB
TLSH	T17CE1AEBE0344CD51F87CA412D3715A5A97D79FB5F196A62A17004F602F4872D8CC03E9
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	FormBook rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

69

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	RFQ_780236427.js
File size:	73'001 bytes
SHA256 hash:	6c93ad9f29b8f14a17a256aeaa9d3a11cee47a427a306b309b8a6c78d9ac34ea
MD5 hash:	b63c0aa08e1dd7d832d5afbca7522c30
MIME type:	text/plain
Signature	Formbook

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b18e075d-29fb-4a09-8212-b44fd5e40157/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a1efb0cf8676ad4d3606264

Tags:

obfuscate xtreme shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm fingerprint repaired

Link:

https://www.filescan.io/uploads/6a1efb0812da0d249c619d30/reports/3ec553c0-07b2-449a-b376-d4b4235b9b1a/overview

Hybrid Analysis HEUR/Suspar.Generic

Verdict:

Suspicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/2f11239de0fc9d8cdf27c8f055f142facc2096bd30b9466e2d5e4b73b8d2bc01

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

First seen:

2026-06-02T09:23:00Z UTC

Last seen:

2026-06-02T09:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2f11239de0fc9d8cdf27c8f055f142facc2096bd30b9466e2d5e4b73b8d2bc01/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2f11239de0fc9d8cdf27c8f055f142facc2096bd30b9466e2d5e4b73b8d2bc01/

ReversingLabs TitaniumCloud Win32.Trojan.Sonbokli

Threat name:

Win32.Trojan.Sonbokli

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-02 11:10:49 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

8 of 36 (22.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f4ishhpa7soyzxzhzdyfl4kc7lgcbfv5gc4um3rnlzfxhogsxqaq._file

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260602-yc4hxaew7j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Family: Formbook

Formbook payload

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2f11239de0fc9d8cdf27c8f055f142facc2096bd30b9466e2d5e4b73b8d2bc01