MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bb1496e66ce154f68fcb8df8f4e282b64d9783f1058ec05433415052d10ad76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bb1496e66ce154f68fcb8df8f4e282b64d9783f1058ec05433415052d10ad76
SHA3-384 hash: 92851cceb97cbe26991bb4da7c4b6d0c53b352f075409278b20189ef3cff5349314d0c7ffb2b41ec08d23007a3fe0a79
SHA1 hash: 11f247d31babaffcb3a3c305e197a40ef74d86ca
MD5 hash: dccf955208ef8a967a8e6f19f8599741
humanhash: carbon-delaware-hawaii-maine
File name:AUG SOA PAYMENT.js
Download: download sample
Signature Formbook
Create hunting rule
File size:75'563 bytes
First seen:2025-09-15 07:20:29 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:ieQrqp4wvMzQ5sVsY8VQQf5K84KTYEtInWJAvjzrnWK45iVas7PWyWz7yMEa9PEF:ii4xzQ6VsYi/f5eKc
Threatray 211 similar samples on MalwareBazaar
TLSH T15C73DB16FB379CA86561A30E34852000D5A4AB2EB4F45810FB5E6AD07B73F1B8E5C5BF
Magika javascript
Reporter Anonymous
Tags:FormBook js

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
PL PL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Script.SNH-gen.81532571.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c7be55d49ea3f1e4b5d484
Tags:
obfuscate xtreme virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm masquerade obfuscated threat
Link:
https://www.filescan.io/uploads/68c7be5273287948292a229c/reports/cd74fcea-f7fb-408d-b8ad-5cf52236478c/overview
Verdict:
Malicious
Labled as:
Trojan.JS.Agent.JS
Link:
https://www.hybrid-analysis.com/sample/7bb1496e66ce154f68fcb8df8f4e282b64d9783f1058ec05433415052d10ad76
Verdict:
Malicious
File Type:
js
First seen:
2025-09-14T21:15:00Z UTC
Last seen:
2025-09-14T21:15:00Z UTC
Hits:
~1000
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/7bb1496e66ce154f68fcb8df8f4e282b64d9783f1058ec05433415052d10ad76/results?tab=lookup
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/7bb1496e66ce154f68fcb8df8f4e282b64d9783f1058ec05433415052d10ad76
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Html
Link:
https://app.malva.re/file/dccf955208ef8a967a8e6f19f8599741
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7bb1496e66ce154f68fcb8df8f4e282b64d9783f1058ec05433415052d10ad76/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/7bb1496e66ce154f68fcb8df8f4e282b64d9783f1058ec05433415052d10ad76
Threat name:
Script-JS.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-09-15 00:32:21 UTC
File Type:
Text (JavaScript)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=poyus3tgzyku62h4xdpy6trifnsns6b7cbmoybkdgqkqkliqvv3a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0e6b25555ea3bc08519eef033a4518f27121f7e7cace0271e456a361534fe69d
Formbook
664272d1c9d15f1747c86d06066467ccdc54ce0062e1d201950a5a95478f1d99
Formbook
693326e19e98db0b09372ddd5d454b3c23db0fbd20dc2e1671d7395fd150010c
Formbook
7343fde1eb7ed90af6b923297177ae109f2ff9b8e86cee4f5961cf619fad81f4
Formbook
8c2bf37543f505883716f27429754461c61c2b259a882942e59b4ecd0f279b80
Formbook
8e3ac942df072256abcf91e4f1e5c76a09093374a9f5b997905dfc5a8b949e2a
Formbook
9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89
Formbook
d54eb1027281e9a83ca07c521d6db3090320cccf8a5424a2d191cbdc1b54b743
Formbook
dccde739186bcc2b12daae93ada247895c811ec080cf06fd4d431d2caecdc196
Formbook
error
Formbook
+ 201 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook execution rat spyware stealer trojan
Link:
https://tria.ge/reports/250915-h6h63awygs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://archive.org/download/optimized_msi_20250904/optimized_MSI.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7bb1496e66ce154f68fcb8df8f4e282b64d9783f1058ec05433415052d10ad76

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:OBFUS_PowerShell_Common_Replace
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the common usage of replace for obfuscation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments