MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd
SHA3-384 hash: 8f69c55236ddbe5f5d91543a621014c33e186d008591cc68b32fe0363abaf7ccabac89a58c4b3f1b36e9f3d0296f7501
SHA1 hash: 972218382c191d044c80a562cbaf3367db4a2e5e
MD5 hash: 0eedfc0f84826f3fa26d790a3391ae11
humanhash: nevada-december-earth-august
File name:z1EMATRASONF170150.vbs
Download: download sample
File size:1'867'099 bytes
First seen:2025-12-09 15:00:07 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:DPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPg:M
Threatray 2'020 similar samples on MalwareBazaar
TLSH T1FC85C1CF47AE4909D6BC1EB9EC01ED8B57EB72471F45236A740FBAD5E004864F580B8A
Magika txt
Reporter FXOLabs
Tags:vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
43
Origin country :
BR BR
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/44005/
Detection(s):
Porcupine.Trojan.Script.Generic.468273.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69383991bde6a3e5970f64c8
Tags:
obfuscate xtreme shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 base64 fingerprint obfuscated obfuscated overlay powershell
Link:
https://www.filescan.io/uploads/6938398d64bd958a520f11fc/reports/323970c2-e3a2-4bad-b526-8302fb2a42bb/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd
Verdict:
Malicious
File Type:
vbs
First seen:
2025-12-09T11:54:00Z UTC
Last seen:
2025-12-11T12:09:00Z UTC
Hits:
~1000
Detections:
Backdoor.Agent.TCP.C&C Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd/
Verdict:
Malicious
Threat:
Trojan.Agent.TCP
Link:
https://tip.neiki.dev/file/30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd
Threat name:
Script-WScript.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-09 15:00:31 UTC
File Type:
Binary
AV detection:
6 of 37 (16.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gd26wxn5ndcprg7mja62luyait2dm33i35wcmzz6xldd34swdpgq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
6c803b2d7bebfebf374aece5ddcd4f470aeb681d88c22e0b8fe361d4f3c33f35
96b5f548190e75840e623792ee01e9561d1f88a89c6fdce734a6cc9a038523ea
a6474ff036306675649f2436c672971e47a2b4378f066949c4f2fa73cebcbffe
eff06ffe78c495491ce7eff1ed8b140f4ba023126edf85fb248fdf894f40a3c4
error
+ 2'010 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/251209-sdjbgags6f/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Process spawned unexpected child process
Malware Config
Dropper Extraction:
http://dn710107.ca.archive.org/0/items/msi-pro-with-b-64_20251208_1511/MSI_PRO_with_b64.png
Malware family:
DnlibLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/30f5eb5dbd68/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Visual Basic Script (vbs) vbs 30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/44005/

Comments