MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RodexRMM

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e
SHA3-384 hash:	fc5a197f969c46b78188f44381d77a4039fa0943375c894b0d195341fb71650b2977a3348f2e15190783a2ff330962a5
SHA1 hash:	536d74dfa263e81932aafb399f708d1cb3c70fde
MD5 hash:	6a87b2060e11772379205f10f1ed0783
humanhash:	potato-edward-violet-music
File name:	AccessWinRAR.vbs
Download:	download sample
Signature	RodexRMM Create hunting rule
File size:	5'263 bytes
First seen:	2026-04-03 14:56:51 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	96:JmYHieJiIRT8eBEscOcml/2OltnF7xhyOI/C/MhSRfAHitkNxdKswQcANyaoF/r/:JmYHi5IyeBENOHl/2O97xhrI/C/qxn/c
TLSH	T101B1B61F6D17E5B06536CF58863BBC2CDA91A027C86164583A9CC4C68F70E2CCDA45EF
Magika	vba
Reporter	JAMESWT_WT
Tags:	45-61-151-3 RodexRMM vbs

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/60352/

Detection(s):

Sanesecurity.Malware.26618.JsHeur.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cfb3e1fe630d45bf232fa0

Tags:

phishing dropper virus sage

Verdict:

Malicious

Labled as:

HEUR_Trojan_Script_Generic

Link:

https://www.hybrid-analysis.com/sample/0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e

Verdict:

Malicious

File Type:

vbs

First seen:

2026-04-01T07:13:00Z UTC

Last seen:

2026-04-05T05:53:00Z UTC

Hits:

~100

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan.Win64.Agent.sb Trojan.Win32.Agent.sb Trojan-Dropper.Win32.Injector.sb Trojan-Downloader.JS.SLoad.sb

Link:

https://opentip.kaspersky.com/0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e/results?tab=lookup

Score:

59%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e/

Verdict:

Malicious

Threat:

Trojan-Downloader.Win32.Injector

Link:

https://tip.neiki.dev/file/0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=boypuh3q4xvjhrmwizpcnlpgdqbm2wl26zetncwwupabkrbcjypa._file

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion spyware trojan

Link:

https://tria.ge/reports/260403-sbmk4sct3q/

Behaviour

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies system certificate store

Runs net.exe

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Launches sc.exe

Drops file in System32 directory

Looks up external IP address via web service

Checks computer location settings

Deletes itself

Executes dropped EXE

Badlisted process makes network request

Downloads MZ/PE file

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0bb0fa1f70e5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	detect_tiny_vbs Create hunting rule
Author:	daniyyell
Description:	Detects tiny VBS delivery technique

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)