MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4faad793253d32d0c6c7a5d0ec7526f546c5e980599b5e635ca40153fd782643. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4faad793253d32d0c6c7a5d0ec7526f546c5e980599b5e635ca40153fd782643
SHA3-384 hash: 41d0a8f86c280fd58cbfbc0ef2905e61a30973aa5fe79d95f86923f9d2bd195e9c81ebd55470737cc5ece182dba85e5e
SHA1 hash: b0a203015708ca5bb442a8224379b7348b331c11
MD5 hash: c5baa116513ebc302cffc1e2ccf46ffd
humanhash: hawaii-emma-beryllium-florida
File name:SSA_Viewer.vbs
Download: download sample
File size:1'254 bytes
First seen:2026-03-17 14:17:09 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 24:1zdzPK2hNZUlNeltZ6BI56w1AZUMaFSOF:1zlXNZUlclD6BIbAZM
Threatray 1'792 similar samples on MalwareBazaar
TLSH T13D219C8F6206B2549EB2521586C73D3CEA826F328E9070B45FE8854CCD21779B3AD497
Magika vba
Reporter Anonymous
Tags:vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/57759/
Detection(s):
SecuriteInfo.com.Script.SNH-gen.93635727.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69b962b693b644ca466aefa4
Tags:
dropper xtreme overt
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive expand lolbin msiexec powershell powershell rundll32
Link:
https://www.filescan.io/uploads/69b962752000fc76c3e5b9aa/reports/c90e0a40-0ed2-4bfd-9773-cfd950393850/overview
Verdict:
Malicious
Labled as:
PowerShell/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/4faad793253d32d0c6c7a5d0ec7526f546c5e980599b5e635ca40153fd782643
Verdict:
Malicious
File Type:
vbs
Detections:
Trojan-Downloader.JS.SLoad.sb Trojan.Win32.Agent.sb HEUR:Trojan.Script.Generic PDM:Trojan.Win32.Generic not-a-virus:RemoteAdmin.MSIL.ConnectWise.c not-a-virus:RemoteAdmin.MSIL.ConnectWise.d not-a-virus:RemoteAdmin.MSIL.ConnectWise.b not-a-virus:RemoteAdmin.MSIL.ConnectWise.a not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen
Link:
https://opentip.kaspersky.com/4faad793253d32d0c6c7a5d0ec7526f546c5e980599b5e635ca40153fd782643/results?tab=lookup
Verdict:
Malware
YARA:
2 match(es)
Tags:
Batch Command DeObfuscated PowerShell PowerShell Call Powershell: Hidden Execution Scripting.FileSystemObject VBScript WScript.Shell
Link:
https://app.malva.re/file/c5baa116513ebc302cffc1e2ccf46ffd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4faad793253d32d0c6c7a5d0ec7526f546c5e980599b5e635ca40153fd782643/
Verdict:
Malicious
Threat:
RemoteAdmin.MSIL.ConnectWise
Link:
https://tip.neiki.dev/file/4faad793253d32d0c6c7a5d0ec7526f546c5e980599b5e635ca40153fd782643
Threat name:
Script.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-03-17 13:49:26 UTC
File Type:
Text (VBS)
AV detection:
5 of 22 (22.73%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6vnpezfhuznbrwhuxioy5jg6vdml2malgnv4y24uqavh7lyezbq._file
Verdict:
malicious
Label(s):
admintool_screenconnect
Create hunting rule
Similar samples:
039359cb8c082a4fe2c867b1bb6ed159615ed4cfaf4e6532ddbdd16bf53ebfe8
119e0f88cfcefe70884d5958d9078f7bacf465a2109eea6d8c2e254244ad58a6
29dac2d3b58b2c7ac6d872d68a3d71fdb4b78b1f9420738e107006087457df71
9bb8e7b466dd8e068dee78cb714c1061c198698442c259b02aaf94b07aeed714
ddaba68dfac28852d3936c8ca86b9061d754e02bd20c15ab36504805f634b0be
error
f71e8c66a51b05bb87941d2ab45dde1b83d97c32bd6443b80d04e8df6e419d11
f7db0fb97ee95b9f4a6175c66496bad6bed4ed5b0c2ad73c2ce27013e17b9dad
+ 1'782 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor discovery execution persistence privilege_escalation ransomware rat revoked_codesign
Link:
https://tria.ge/reports/260317-rlxcmaet5x/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Boot or Logon Autostart Execution: Authentication Package
Drops file in System32 directory
Enumerates connected drives
Checks computer location settings
ConnectWise ScreenConnect remote access tool
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Sets service image path in registry
Signed with revoked ConnectWise certificate
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4faad793253d32d0c6c7a5d0ec7526f546c5e980599b5e635ca40153fd782643

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/57759/

Comments