MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6
SHA3-384 hash: 05f94fb5818e9ce817ae8c741adcc399c265a856a33fbe932810939f78702c7089d3273eb835721bf8f15f16dcbd1d30
SHA1 hash: 11a355c4173f3f5bc1d3a1fa0e04e0a266a7ba4e
MD5 hash: 9e9a2f6ef6b242edfccfece4cade10ef
humanhash: blossom-helium-two-north
File name:0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6.vbs
Download: download sample
File size:914 bytes
First seen:2025-12-03 07:11:48 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 24:9A+ssSZh+J4QGMG2k+AcD0rR6nG5CtRMWfej8qWY/Van:eWe+6Qlzd0ruG8tRPfeL/E
Threatray 716 similar samples on MalwareBazaar
TLSH T1E111EF0B6D18D4B64970C0875C64A91DEDC3A413400E5DB1F21D480C9F397BAA5C1C97
Magika vba
Reporter JAMESWT_WT
Tags:purerat32-duckdns-org vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
39
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42208/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692fe2d016e6db515e4628c6
Tags:
ransomware xtreme shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/692fe2cd37f663155c35d798/reports/4527e682-c608-45dd-8713-28fb890249e4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6
Verdict:
Malicious
File Type:
vbs
First seen:
2025-11-01T11:04:00Z UTC
Last seen:
2025-12-01T18:57:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6/results?tab=lookup
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6
Verdict:
Malware
YARA:
2 match(es)
Tags:
Batch Command DeObfuscated MSXML2.XMLHTTP PowerShell PowerShell Call Powershell: Hidden Execution VBScript WScript.Shell
Link:
https://app.malva.re/file/9e9a2f6ef6b242edfccfece4cade10ef
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-11 16:23:42 UTC
File Type:
Text (VBS)
AV detection:
6 of 23 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6xxaz7elqvdfcomlbjszqpddslw3bhksq534yj7psk3xr6xcx3a._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
Similar samples:
073e4daf286173372555f2c0525977bb8164febab473bdb3b29add90c2667acb
16979f2060a835ff4b481cc0e192ac0302f65e3fa9e389e53b8e79f52821d0cb
37fa5a4fd4cc772735a96fef23037e24c503ff7857858c80e68ff28d5c77ad79
3878f3f1949dd54c9928e88702c4c6159eb759d22f87d84192265b9d6c762605
6a724eb42d810bdcd5ae0ff16c4816072ff5fd54bb4e45e036c10c0e070a4664
859de7f0b61c2ce5e61b9737583fb72a80b0219c13c200a2d0de3e0da7f38307
cdf18dce59da13a347c6d2d60a0bf6190228b46e595863308769a1cb34ca5fd0
e2ae3121af3fd9874ba17612b0c012ca1962dfd918cc1d479384dad7bf469c64
error
f2798987ff79bfd4a9cf2b5877ae520d4ed823912f5338e9bf3c4735c70859e2
+ 706 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution
Link:
https://tria.ge/reports/251203-h1mbjagl6t/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:PowerShell_Susp_Parameter_Combo_RID336F
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42208/

Comments