MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5728fe1fbdd76d4b0ddb5e3cacb1aab8ccdaa03e6b53d497255eb24926f0ea67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5728fe1fbdd76d4b0ddb5e3cacb1aab8ccdaa03e6b53d497255eb24926f0ea67
SHA3-384 hash:	b24b78b0a8bd2a8bab29687d62c2723b51429b6368768c0724493eb0398c8ef0af0647cca9fd4da36fc46eac6785eea4
SHA1 hash:	a7f445c5b9ecf11234474e74b623351d052f8596
MD5 hash:	d004101a2a747c086835148e400462f7
humanhash:	spring-robin-whiskey-tennessee
File name:	COAU7260933760.vbs
Download:	download sample
File size:	26'958 bytes
First seen:	2025-08-22 14:56:36 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	384:duMBjmqhD09v1TBkg44BS9kWIkeLdIoenFm9H4XLSnRHvtCFinZeC7T9r7n:o6aqhD09v1TBR/AYLvDH+LhwZeC7T5n
TLSH	T1C0C2C767FF0963788B02674A9E0D12299D6412A31A339978FF3DC56F0F2743597B4E88
Magika	vba
Reporter	abuse_ch
Tags:	vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

27

Origin country :

SE

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/22974/

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a88533e9d9dbcfd96d178b

Tags:

obfuscate xtreme spawn

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68a88568fc438b9ff4b7d743/reports/229633d8-db73-4b07-91b0-7ab60a8af7b2/overview

Hybrid Analysis Valyria

Verdict:

Malicious

Labled as:

Valyria

Link:

https://www.hybrid-analysis.com/sample/5728fe1fbdd76d4b0ddb5e3cacb1aab8ccdaa03e6b53d497255eb24926f0ea67

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2025-08-22T10:16:00Z UTC

Last seen:

2025-08-22T10:16:00Z UTC

Hits:

~1000

Detections:

Trojan-Downloader.Agent.HTTP.C&C HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/5728fe1fbdd76d4b0ddb5e3cacb1aab8ccdaa03e6b53d497255eb24926f0ea67/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1763078

Signature

Creates processes via WMI

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5728fe1fbdd76d4b0ddb5e3cacb1aab8ccdaa03e6b53d497255eb24926f0ea67

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

Batch Command DeObfuscated PowerShell PowerShell Call Scripting.FileSystemObject SMTPControl.SMTP VBScript

Link:

https://app.malva.re/file/d004101a2a747c086835148e400462f7

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5728fe1fbdd76d4b0ddb5e3cacb1aab8ccdaa03e6b53d497255eb24926f0ea67/

Neiki Text.Trojan.Valyria

Verdict:

Malicious

Threat:

Text.Trojan.Valyria

Link:

https://tip.neiki.dev/file/5728fe1fbdd76d4b0ddb5e3cacb1aab8ccdaa03e6b53d497255eb24926f0ea67

ReversingLabs TitaniumCloud Script-WScript.Trojan.Valyria

Threat name:

Script-WScript.Trojan.Valyria

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-22 14:57:44 UTC

File Type:

Text (VBS)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k4up4h5525wuwdo3ly6kzmnkxdgnvib6nnj5jfzfl2zesjxq5jtq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion execution

Link:

https://tria.ge/reports/250822-sbyclsal5y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Modifies trusted root certificate store through registry

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://192.3.177.152/xampp/optimized_MSI.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5728fe1fbdd76d4b0ddb5e3cacb1aab8ccdaa03e6b53d497255eb24926f0ea67

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/22974/