MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ec6d16fd83f3749bddf7c9fdb6cfded2a7fe32e4dfdd4fed003f82e4ab99b0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0ec6d16fd83f3749bddf7c9fdb6cfded2a7fe32e4dfdd4fed003f82e4ab99b0e
SHA3-384 hash:	2daeb48d39c99a566ee1f56f0890fafdcc4f65f65cadfb9d8e60982307646e814e5fbddf788868f46267f0331791ff35
SHA1 hash:	4583aebc361c0c5bf9e1ff9554cdfae1e2d15651
MD5 hash:	473a72ca53436f211fb55f4f3dc5da4c
humanhash:	violet-chicken-alanine-india
File name:	silent.vbs
Download:	download sample
File size:	221 bytes
First seen:	2026-10-21 18:37:27 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	6:j+q9NqcN7fBMbHZGnc4KFrFHJhn6NNEEHZtyJHb8n:KqacN1SCAFHJhnSE0Qy
TLSH	T1D0D0A79F60086C73E50A81E42221C50B05D9E54411D2FC76494184058104CF073632C9
Magika	batch
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

76

Origin country :

AT

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/93693/

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad90695afb06e650cd86470

Tags:

overt agent sage

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/0ec6d16fd83f3749bddf7c9fdb6cfded2a7fe32e4dfdd4fed003f82e4ab99b0e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-10-21T16:51:00Z UTC

Last seen:

2026-10-22T08:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0ec6d16fd83f3749bddf7c9fdb6cfded2a7fe32e4dfdd4fed003f82e4ab99b0e/results?tab=lookup

Nucleon Malprob Susipicious

Score:

32%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/0ec6d16fd83f3749bddf7c9fdb6cfded2a7fe32e4dfdd4fed003f82e4ab99b0e

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

Batch Command COM Behavior Trace DeObfuscated Obfuscated PowerShell PowerShell Call T1027 T1059 T1059.001 T1059.005 T1105 VBScript WScript.Shell

Link:

https://app.malva.re/file/473a72ca53436f211fb55f4f3dc5da4c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ec6d16fd83f3749bddf7c9fdb6cfded2a7fe32e4dfdd4fed003f82e4ab99b0e/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b3dnc36yh43utpo7psp5w3h55uvh7yzojx65j7wqap4c4svztmha._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion execution persistence

Link:

https://tria.ge/reports/261021-w97kqaxs4j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

cURL User-Agent

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Executes a VBScript file via the Windows Script Host.

Indicator Removal: File Deletion

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/0ec6d16fd83f3749bddf7c9fdb6cfded2a7fe32e4dfdd4fed003f82e4ab99b0e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/93693/