MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51473dd2b6ac0bfc7beae6bdddfd49a55465cd51b9a62383b2b7dc3867bf5e9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	51473dd2b6ac0bfc7beae6bdddfd49a55465cd51b9a62383b2b7dc3867bf5e9b
SHA3-384 hash:	a452f82bfc3403b3d498974fa380f02c98010875ac0aadadc4886f9018a8cea934f36cc806ef9068e71a3996e05ee2ec
SHA1 hash:	eabf988bfbf8be98d847c86470852680960434c3
MD5 hash:	618c7addafef6ad67a62ba86e01a51a8
humanhash:	berlin-apart-batman-yankee
File name:	WBOMRQRB_629720855.vbs
Download:	download sample
Signature	ConnectWise Alert Create hunting rule
File size:	1'676 bytes
First seen:	2026-09-04 11:50:06 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	48:eRnfdL6oDOzJN/rEWWAl7AN06MBj9acLywiLp:ePLtAJO1WciBB5JOV
TLSH	T1D531508EB82D91388D228193F6AAF82CCDE04F6AAE731480B5148506CE489BCE64D14B
Magika	vba
Reporter	BastianHein
Tags:	ConnectWise vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

87

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/83900/

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

captcha downloader dropper evasive lolbin msiexec

Link:

https://www.filescan.io/uploads/6a9ab07ec20c32592ab1f8fc/reports/5c79893e-07b7-4333-b74c-90e14bd79f0b/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/51473dd2b6ac0bfc7beae6bdddfd49a55465cd51b9a62383b2b7dc3867bf5e9b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-09-04T05:48:00Z UTC

Last seen:

2026-09-04T06:38:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/51473dd2b6ac0bfc7beae6bdddfd49a55465cd51b9a62383b2b7dc3867bf5e9b/results?tab=lookup

Nucleon Malprob Malware

Score:

88%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/51473dd2b6ac0bfc7beae6bdddfd49a55465cd51b9a62383b2b7dc3867bf5e9b

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

ADODB.Stream COM Behavior Trace MSXML2.XMLHTTP Scripting.FileSystemObject SOS: 0.18 T1059 T1059.005 T1105 VBScript WScript.Shell

Link:

https://app.malva.re/file/618c7addafef6ad67a62ba86e01a51a8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/51473dd2b6ac0bfc7beae6bdddfd49a55465cd51b9a62383b2b7dc3867bf5e9b/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kfdt3uvwvqf7y67k426537kjuvkgltkrxgtcha5sw7odqz57l2nq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260904-nzrgrawvhy/

Behaviour

Executes a VBScript file via the Windows Script Host.

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/51473dd2b6ac0bfc7beae6bdddfd49a55465cd51b9a62383b2b7dc3867bf5e9b

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/83900/