MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e174bed224b9433ed8d3cc0f922b626a541c528edd1e8be79338f727151aff4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2e174bed224b9433ed8d3cc0f922b626a541c528edd1e8be79338f727151aff4
SHA3-384 hash:	83d39efa66b32c928b3f884dd8cd8fd14990561c3330c6913cdcf87732b6bf3f07a81716a823b2e136e44c208dfce42b
SHA1 hash:	ac2e47c6405640657f94e072772153c960512cab
MD5 hash:	d946af41343c65278a8513a85938c7a6
humanhash:	fruit-sweet-india-social
File name:	kion.odd.vbs
Download:	download sample
File size:	22'131 bytes
First seen:	2025-10-28 12:20:27 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/html
ssdeep	384:P9nTAxQTKm+XcV/2ljKfft7h/QYwdTy+euo3/mFoZ8y9:P9nTAxTxpoBhY3dIr
TLSH	T141A252393D9BB404A93DE616957FA315E8A9348B9D018CD334C3399327037DA6AC35BE
Magika	html
Reporter	JAMESWT_WT
Tags:	185-198-234-30 vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

16

Origin country :

IT

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6900b535706befaf4ec9a541

Tags:

n/a

Hybrid Analysis GT:VB.ObfDldr.31

Verdict:

Malicious

Labled as:

GT:VB.ObfDldr.31

Link:

https://www.hybrid-analysis.com/sample/2e174bed224b9433ed8d3cc0f922b626a541c528edd1e8be79338f727151aff4

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

html

Link:

https://opentip.kaspersky.com/2e174bed224b9433ed8d3cc0f922b626a541c528edd1e8be79338f727151aff4/results?tab=lookup

Nucleon Malprob Malware

Score:

75%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2e174bed224b9433ed8d3cc0f922b626a541c528edd1e8be79338f727151aff4

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/d946af41343c65278a8513a85938c7a6

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Downloader.Generic

Threat name:

Win32.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-10-27 07:59:53 UTC

File Type:

Text (VBS)

AV detection:

5 of 36 (13.89%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fylux3jcjokdh3mnhtapsivwe2sudrji5xi6rptzgohxe4krv72a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  4/10

Tags:

discovery

Link:

https://tria.ge/reports/251028-t14rcsaj71/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Drops file in Program Files directory

Drops file in Windows directory

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2e174bed224b9433ed8d3cc0f922b626a541c528edd1e8be79338f727151aff4