MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d48e5ec3a407e3bbc0e9d9d365853a5f49fec7240c2a07d1fad88859ff753be5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d48e5ec3a407e3bbc0e9d9d365853a5f49fec7240c2a07d1fad88859ff753be5
SHA3-384 hash:	6b6b1fd3ce063fb284041872a227ce1830e70ec7b35e923547e9e816993830a0d463fbf1ea18a3a5c3ad20ef290fca6a
SHA1 hash:	741159ce52e9f8c6ddb460e17e54a3b2acb9361b
MD5 hash:	f4be96c6b16e2874efecc4165ec908a0
humanhash:	eighteen-oranges-one-oregon
File name:	wennedrightpersontoanswerforbestfeautrestogivenmebest.vbs
Download:	download sample
File size:	72'292 bytes
First seen:	2025-08-07 12:01:21 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	384:sWiKYva+7hwPxakcDi/gMy10pE9F9cdX9wQxQ0bEe9rhOuE+QUxGVqLQ8VeCwwvh:zM54xXYc03oXpHF
TLSH	T1EF63B1D1CB5A2CE09A95233F737B07D9CAD84EC89D8A2C7A79CBC64AB35231570C7851
Magika	vba
Reporter	JAMESWT_WT
Tags:	107-172-238-5 MSI-STEGO vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

27

Origin country :

IT

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/19476/

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689495b51e8a59ee04e6ffcd

Tags:

obfuscate xtreme spawn

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 obfuscated overlay powershell threat

Link:

https://www.filescan.io/uploads/689495be167d60d98ab604c1/reports/88620825-d495-4c18-9d23-4690f84a850d/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/d48e5ec3a407e3bbc0e9d9d365853a5f49fec7240c2a07d1fad88859ff753be5

Nucleon Malprob Benign

Score:

20%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/d48e5ec3a407e3bbc0e9d9d365853a5f49fec7240c2a07d1fad88859ff753be5

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d48e5ec3a407e3bbc0e9d9d365853a5f49fec7240c2a07d1fad88859ff753be5/

Neiki Trojan.JS.SAgent

Verdict:

Malicious

Threat:

Trojan.JS.SAgent

Link:

https://tip.neiki.dev/file/d48e5ec3a407e3bbc0e9d9d365853a5f49fec7240c2a07d1fad88859ff753be5

ReversingLabs TitaniumCloud Script-WScript.Downloader.RemcosRAT

Threat name:

Script-WScript.Downloader.RemcosRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-05 12:47:57 UTC

File Type:

Text (HTML)

Extracted files:

2

AV detection:

11 of 37 (29.73%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2shf5q5ea7r3xqhj3hjwlbj2l5e75rzebqvapup23ceft73vhpsq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

collection discovery execution

Link:

https://tria.ge/reports/250807-n68plszygw/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Malware Config

Dropper Extraction:

https://archive.org/download/msi_20250801/MSI.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d48e5ec3a407e3bbc0e9d9d365853a5f49fec7240c2a07d1fad88859ff753be5

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/19476/