MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37aef6d5ce36528e10ccc0ef49959c2a83ea025cf8327f8fffefd1ca8b903825. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	37aef6d5ce36528e10ccc0ef49959c2a83ea025cf8327f8fffefd1ca8b903825
SHA3-384 hash:	d62db60d78001ef3cef7d3737436eef005d0962725cde417718d4147328771f1e58c7c54498816fb104c5898033f2cb2
SHA1 hash:	f6e5e1ac66a60f4a42aaf4671773df30371cfd57
MD5 hash:	091eaecfdd7bfbaee163d44d896306df
humanhash:	north-network-august-august
File name:	TT_Payment_Copy.rar
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	7'452 bytes
First seen:	2026-06-02 15:47:27 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	192:Sc8yHjF2MbQ2Ou4MuGPWR2h5HvwKAqacTu7:ScnxbZX4MnPuKA5cTe
TLSH	T147F1BF08B18ACE95C61403B98BB54FDB05D10B1FC30DC849C628B3A249FBACF5A7E4B5
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	FormBook rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

75

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Swift_advise_40k$.js
File size:	73'001 bytes
SHA256 hash:	6c93ad9f29b8f14a17a256aeaa9d3a11cee47a427a306b309b8a6c78d9ac34ea
MD5 hash:	b63c0aa08e1dd7d832d5afbca7522c30
MIME type:	text/plain
Signature	Formbook

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ff819511-c310-4806-874a-33daf34a01bc/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a1efb0cf8676ad4d3606264

Tags:

obfuscate xtreme shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm fingerprint repaired

Link:

https://www.filescan.io/uploads/6a1efb464bb6e36d18095dbe/reports/4b8981da-50f5-43d6-956b-1ad131f45f02/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/37aef6d5ce36528e10ccc0ef49959c2a83ea025cf8327f8fffefd1ca8b903825

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-02T04:34:00Z UTC

Last seen:

2026-06-02T12:12:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/37aef6d5ce36528e10ccc0ef49959c2a83ea025cf8327f8fffefd1ca8b903825/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/37aef6d5ce36528e10ccc0ef49959c2a83ea025cf8327f8fffefd1ca8b903825/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g6xpnvoogzji4egmydxutfm4fkb6uas47azh7d7757i4vc4qhasq._file

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260602-yc4hxaew7n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Family: Formbook

Formbook payload

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/37aef6d5ce36528e10ccc0ef49959c2a83ea025cf8327f8fffefd1ca8b903825