MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89
SHA3-384 hash:	650cc8b8d83ec82f04ba12d1ec9eb7f1294a4deaf2745859e405b5bb9bbbc04d7ee231643a393eec72158e97f3d45d8d
SHA1 hash:	6adc31b28109292604c349c7b2244f374af05ad8
MD5 hash:	cae9776f12090cc823dea9ead36dff4b
humanhash:	quiet-mockingbird-nineteen-march
File name:	aaasda.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	46'272 bytes
First seen:	2025-09-05 06:53:19 UTC
Last seen:	2025-09-08 13:51:14 UTC
File type:	js
MIME type:	text/plain
ssdeep	96:CAfK6PVSVjVdC8cqzg4ALmW8tvsK6iLfc9RTfFHV19HqFQcviXR+s:N7P+VdCrOFQqv9jLWRTdV/KFQcvIR+s
Threatray	135 similar samples on MalwareBazaar
TLSH	T11D23B7409B53DEB9FC29941FA488208A045EE49B866FCAF50E3339E0937155DF497EEC
Magika	javascript
Reporter	Anonymous
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

67

Origin country :

PL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20250905-0133.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ba88e33e988eb6ab83ba35

Tags:

obfuscate xtreme virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 evasive fingerprint obfuscated obfuscated powershell

Link:

https://www.filescan.io/uploads/68ba891920d0ee406d9632d6/reports/27e538c5-ba8c-4258-9d82-35521f16f7f3/overview

Hybrid Analysis Trojan.Script.Dropper

Verdict:

Malicious

Labled as:

Trojan.Script.Dropper

Link:

https://www.hybrid-analysis.com/sample/9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2025-09-04T19:28:00Z UTC

Last seen:

2025-09-04T19:28:00Z UTC

Hits:

~10000

Detections:

Trojan.Agentb.TCP.C&C Trojan.JS.SAgent.sb HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89/results?tab=lookup

Nucleon Malprob Malware

Score:

85%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89/

Neiki Family.FORMBOOK

Verdict:

Malicious

Threat:

Family.FORMBOOK

Link:

https://tip.neiki.dev/file/9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-09-05 05:28:29 UTC

File Type:

Binary

AV detection:

9 of 37 (24.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tkcynd5nvejlozvxk4qrok6y2pdudszjqekjb7mot5jygjys72eq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

37c810d524a8db830dbb9d12d5d918802d3c85619d58810d04fc95232ec393ce

Formbook

664272d1c9d15f1747c86d06066467ccdc54ce0062e1d201950a5a95478f1d99

Formbook

6bc677ac4c36cb99e3170edb2b29b8e8b47399a2896f8f0c6fa998b4337bcf35

Formbook

8c2bf37543f505883716f27429754461c61c2b259a882942e59b4ecd0f279b80

Formbook

8e3ac942df072256abcf91e4f1e5c76a09093374a9f5b997905dfc5a8b949e2a

Formbook

c219396bdbe5ecedd6f6edd308734920f6a52b6cdbefafc16916f07dadffc1c8

Formbook

c83f645369bd6c84db6f1750f895037077647323d811b61b15f34f2ab4f18292

Formbook

dccde739186bcc2b12daae93ada247895c811ec080cf06fd4d431d2caecdc196

Formbook

e119c6c5485307075a1e5d0950a77f978f7f17e23c315ed8c38cc1259b8af26f

Formbook

error

Formbook

+ 125 additional samples on MalwareBazaar

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/250905-hpa45awydv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Suspicious use of SetThreadContext

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Formbook payload

Formbook

Formbook family

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://archive.org/download/optimized_msi_20250904/optimized_MSI.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89