MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82ab90c6dbc6dcac6f50feefe5803427b0ca00ac117deff29fd1ac4ecff58572. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	82ab90c6dbc6dcac6f50feefe5803427b0ca00ac117deff29fd1ac4ecff58572
SHA3-384 hash:	8ceb3604813745c175aed8af19f6ee641f50652c025c537238b4b4a51e323b9eb287cef96bb13d6150d74d85627b5686
SHA1 hash:	6db0772001318bcfe761805a27b5df471187b485
MD5 hash:	b0e9b1aecb228fbfa609bf9715169aba
humanhash:	batman-hamper-oregon-idaho
File name:	nOutstanding_Invs_DHL122025-0976.z
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	700'591 bytes
First seen:	2025-12-23 02:00:33 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	12288:o92qLgI3y6USQNM8siYkeTxCYJDJEMnZJ6/oZqpwKdhGgdypZL6muWIHC3HE1s:AEwGNM8nYkeTxCYnhJ6QBSGbnWmn3Ws
TLSH	T1E3E42305531AA64FB4CC95F7798BB57298B7514FAB318138F18CF21AF216A5E4A328D0
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	FXOLabs
Tags:	FormBook z

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

45

Origin country :

BR

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8061c464-ca80-45b8-bf9f-470363add51a/

ClamAV Detected

Detection(s):

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6949f7c3a6c88bb4cc23c7bc

Tags:

autorun autoit emotet

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint installer-heuristic keylogger masquerade microsoft_visual_cc packed unsafe

Link:

https://www.filescan.io/uploads/6949f7ef84afa5547b5c72df/reports/bb83db5d-35ad-4daf-ba55-286e12ea0151/overview

Hybrid Analysis Mal/DrodRar

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/82ab90c6dbc6dcac6f50feefe5803427b0ca00ac117deff29fd1ac4ecff58572

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2025-12-22T22:41:00Z UTC

Last seen:

2025-12-25T00:22:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/82ab90c6dbc6dcac6f50feefe5803427b0ca00ac117deff29fd1ac4ecff58572/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/82ab90c6dbc6dcac6f50feefe5803427b0ca00ac117deff29fd1ac4ecff58572/

ReversingLabs TitaniumCloud Script-AutoIt.Trojan.Sonbokli

Threat name:

Script-AutoIt.Trojan.Sonbokli

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-23 13:32:43 UTC

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qkvzbrw3y3oky32q73x6labue6ymuafmcf6674u72gwe5t7vqvza._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/82ab90c6dbc6dcac6f50feefe5803427b0ca00ac117deff29fd1ac4ecff58572