MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2
SHA3-384 hash:	fd6f26a6f49f31aadcb05914a329cff132bbcbe800a967f2ad585f8d1304f7f6eee6283c9941a7bd795a16e508d83c90
SHA1 hash:	ef66963faf1c5b92aa24b5d338db71a2a3f1d142
MD5 hash:	f995f165d5d0228101edaa5832891db6
humanhash:	white-lithium-delta-victor
File name:	RFQX11062026.zip
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	20'304 bytes
First seen:	2026-06-12 21:54:44 UTC
Last seen:	2026-06-12 21:56:29 UTC
File type:	zip
MIME type:	application/zip
ssdeep	96:mf2JRWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWv:mf2cqAHq2z1seKqtx5fC97SoruTMGm
TLSH	T14E9269F4AAFFC9202B030D4A7D169DD7E840CE1C65F521650B52CA79E8FD1AD6F8E064
Magika	zip
Reporter	TomU
Tags:	FormBook zip

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

107

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	RFQ 11062026.js
File size:	2'590'099 bytes
SHA256 hash:	d6d6f9c0160cf7bfa97097f58f6acf8cafc8bd657b7aebbd326fea05e9bc3165
MD5 hash:	a44b67d4e2626557bbbc11f3e50c258c
MIME type:	text/plain
Signature	Formbook

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/bad31103-fc7b-45e5-b1f3-8278ad003c25/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_JsNum.v2.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Packed.161.9076.5848.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.32320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2aa9bea15110463ee4c61b

Tags:

obfuscate autorun xtreme blic

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a2c8061bf16337e43c40f12/reports/02e0bac7-01b7-4982-b07c-f0e13c7de652/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-06-11T06:24:00Z UTC

Last seen:

2026-06-14T01:00:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2/results?tab=lookup

Nucleon Malprob Benign

Score:

7%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2/

ReversingLabs TitaniumCloud Win32.Trojan.Kepavll

Threat name:

Win32.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-11 20:34:33 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2