MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16298454e2f01d15de20ea5651abe0c77d73ca3013adaa66d919de9e042a9d3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	16298454e2f01d15de20ea5651abe0c77d73ca3013adaa66d919de9e042a9d3d
SHA3-384 hash:	20534a395627b99e020e05f943343a04cee0fa0ab042479100b7274038fb0122d1d6e10398b693ac9f14dec29718bc8b
SHA1 hash:	a80e8fa5a2b6395eac8a47a78ddedfdbc506a0a2
MD5 hash:	17ad01cded9cce9be82081ad7f0f599a
humanhash:	william-november-massachusetts-autumn
File name:	login_qYxkKH.vbs
Download:	download sample
File size:	1'511 bytes
First seen:	2023-09-26 08:20:58 UTC
Last seen:	Never
File type:	vbs
MIME type:	application/octet-stream
ssdeep	12:IXbuIeOj1Efz0e/Txw+s9FQWxqnHHnRe13hpLR44hFGTmk3tcLukCp48WxJkh7ZW:IXbZi4gxwBnTHLcfbTkUDvT0PWoj
TLSH	T1D631F19B850A00CC8AD2DAD50B00D4C0E9CC104B1578FCF1EE1ECD61C8FD08039C4E2E
Reporter	JAMESWT_WT
Tags:	89-23-100-222 vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

75

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.14617.23926.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6512947032ffdb7a7a148ff2/reports/6c7dc0cc-2efa-4e14-88e6-7d70b0846820/overview

Hybrid Analysis Trojan.Script

Verdict:

Suspicious

Labled as:

Trojan.Script

Link:

https://www.hybrid-analysis.com/sample/16298454e2f01d15de20ea5651abe0c77d73ca3013adaa66d919de9e042a9d3d

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1314478

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (suspicious strings)

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16298454e2f01d15de20ea5651abe0c77d73ca3013adaa66d919de9e042a9d3d/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Darkgate

Threat name:

Script-WScript.Trojan.Darkgate

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-09-26 06:57:35 UTC

File Type:

Binary

AV detection:

4 of 23 (17.39%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cyuyivhc6aorlxra5jlfdk7ay56xhsrqcow2uzwzdhpj4bbktu6q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230926-n869kahb3z/

Behaviour

Script User-Agent

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/16298454e2f01d15de20ea5651abe0c77d73ca3013adaa66d919de9e042a9d3d