MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783
SHA3-384 hash: cd67425325120a5ace8ce22f16844c90937e8f295b7beef319bc66f3aeebc0684449ab8a513598cdef8cff2d23e010e8
SHA1 hash: 43d26282d440a3e62df50b33eb337309a26108a0
MD5 hash: 39a45211aa4441e05852ee463f6c77d6
humanhash: texas-friend-fruit-kilo
File name:kbgknw.vbs
Download: download sample
File size:203'922 bytes
First seen:2026-04-25 16:44:26 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 6144:9t21wGeCogNVksyUB2zWFIi8D/Tg9QQifS1w+VjAF:j2deUJy3WFYDbg6gBWF
Threatray 166 similar samples on MalwareBazaar
TLSH T143146B722EA70124642BCDE53DF57466AE4EF731A55CB00C01851B2FC962EE5CEB06EE
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika vba
Reporter BastianHein
Tags:vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
CL CL
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/63594/
Detection(s):
SecuriteInfo.com.Other.Malware-gen.72637632.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ecefbf4aed15d07930533e
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/69ecefb9c06ec088bf5e61ab/reports/260f8404-81bc-4814-b7b7-a50337a95610/overview
Verdict:
Malicious
Labled as:
VBS/Agent.CRT
Link:
https://www.hybrid-analysis.com/sample/0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783
Verdict:
Malicious
File Type:
vbs
First seen:
2026-04-25T13:58:00Z UTC
Last seen:
2026-04-27T00:34:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic
Link:
https://opentip.kaspersky.com/0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783/results?tab=lookup
Score:
45%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783/
Verdict:
Malicious
Threat:
Trojan.Script
Link:
https://tip.neiki.dev/file/0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=btdxo6b4yt7r5fmvicg23o366ux7yiw3jxdig47wutufmstdg6bq._file
Verdict:
malicious
Label(s):
stubrunner
Create hunting rule
Similar samples:
7ac8844c577a69405eaf28e397fe1d3bd2d98e899d4164dde2bc4367d95f0d7a
921fd2918a88f08af5f2513a9e9edfd2b954f3a562f7e237bd4f7f1b05662c6e
976375b82b1ef466d7d76f8afce7b75958edb3cf63fc4b430e7680a34cf90835
b61840fe8bb0aa16fd4d45470b8ea7b1fefbd639e197bd182b202ed7b083279b
c778eba8e5385b17a51bbef0e1b3c51db6dc485378c90cff1b9db7aad67c8349
caf5a5db7e61fbc92ac5854b25078c5d91104a8d2dd0179a3264ead8a305ea7a
d8746ea25efc80ae0088dae481c1b923b44981cdc95c649981349f8895768176
dd1768b5779b29847e91476b77e4b3c506d0a3ff4ac430e0f06292fd1b17a390
e4390b6c526c0efc9ba624c413e5b6298105743af6046f42edbe49c98b63e23f
e4856f65f0024e68034394f3419a235602e56348b88bf73dcb5a53a20684d35b
error
+ 156 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/260425-t835ssd16v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/0cc777783cc4ff1e9595408dadbb7ef52ffc22db4dc68373f6a4e8564a633783

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_VBS_Wscript_Shell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/63594/

Comments