MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9aa66bba7252d0569dd5dad455fb093c0d100bf97995e94e7626dd757afcb0cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9aa66bba7252d0569dd5dad455fb093c0d100bf97995e94e7626dd757afcb0cb
SHA3-384 hash:	5f861ed6ee5bd249b589cf2eaef4128d5a7ddc785eeee6b85a6d75eca731d894c20bfa4902a73cba10d4afc331514e14
SHA1 hash:	a41dfcb5e605e598b3d2c212c4a8abc5937f65d0
MD5 hash:	d0dd0626fcbda4cc97c682d667f74916
humanhash:	football-texas-one-angel
File name:	New Order.vbs
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	59'449'712 bytes
First seen:	2025-04-09 06:42:59 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:KvSSS6SSS6SSS6SSS6SSS6SSS6SSS6SSS6SSS6SSS6SSS6SSS6SSS6SSS6SSS6Se:KiQb7SOE9/cm6wK
Threatray	32 similar samples on MalwareBazaar
TLSH	T133D782E233F1510CBAFB6F45787A225A66BE7DC25C39D56C829014869DB6F40C6B03B3
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	mp3
Reporter	abuse_ch
Tags:	FormBook vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

96

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f61e13f9ba909217cd94b8

Tags:

autorun xtreme shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/67f6170940adfb5162bd15cb/reports/968e9eba-19d4-4406-b9df-eb7faa650ee1/overview

Hybrid Analysis NetWorm

Verdict:

Suspicious

Labled as:

NetWorm

Link:

https://www.hybrid-analysis.com/sample/9aa66bba7252d0569dd5dad455fb093c0d100bf97995e94e7626dd757afcb0cb

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1660417

Signature

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Paste sharing url in reverse order

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

57%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/9aa66bba7252d0569dd5dad455fb093c0d100bf97995e94e7626dd757afcb0cb

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-WScript.Trojan.QuasarRAT

Threat name:

Script-WScript.Trojan.QuasarRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-09 01:21:53 UTC

File Type:

Text (VBS)

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tktgxotsklifnhov3lkfl6yjhqgrac7zpgk6sttwe3oxk6x4wdfq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

17dd3793d4bbf9e90e53df26678489a7b82e65d1eeecf396eb088b444a164f85

Formbook

19b9972f970ca207cf8494582bdf8c68b8a1f9cbbc9a8df0151d05c26cb9b3a1

Formbook

2810c06ccf0230a24179363862bfd4e88dab05b1b39fb229d75b8f01973fdb80

Formbook

2be211f45f8595e6e9b55ba227173aed35eb1ce53fb119beceb49f236232814d

Formbook

acae2eb792f7d641ffa6b0fb92e885db935307ba0dba00afe113b78a9c1d267f

Formbook

cca8da99cc7f736fd140ca8c52a82d00d9587def174d4385302f8cc4bccfcce0

Formbook

cdc2106e6e47fe9e06e5c1b655b8428706cf3db33e31b854ddf3e1269d9c7978

Formbook

cdff410d32d5b177320f80eb8bc6be51de994bd11cc17e7013ae400e1947ca6f

Formbook

error

Formbook

fd0da5a488e7d4bf274e63bc23f649a200e234fdfa75a2fa2b77c5db334b8f1c

Formbook

+ 22 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution persistence

Link:

https://tria.ge/reports/250409-hg2l4sstdv/

Behaviour

Modifies Internet Explorer settings

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Hide Artifacts: Hidden Window

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Drops startup file

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Malware Config

Dropper Extraction:

https://pastebin.com/raw/pzXGkayU

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.