MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30
SHA3-384 hash: 338c46205a97d4aa1fa7cce806a90ff20100b08b8d330178ec2a8c6fceaccd6091f0d91e33a69e2472426f5d52dad205
SHA1 hash: bdee381e1bb0f8f23ea060baf0559350b00f6d2d
MD5 hash: 87661f4dba23fbca6c827329ebf7af36
humanhash: item-alanine-jersey-network
File name:z1INV_PAYMENT.vbs
Download: download sample
File size:38'911 bytes
First seen:2026-07-24 07:00:05 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:8LW8UC05+GrZ+t5rerkwpyrI2nnurykwp+ro+5U5fyrId8UC05+GrEwrz+f52nnQ:9JU//xa
TLSH T18A039786B89EF449138C4D8D2F8DAD242F6D977969748DD624A9B31506C90ACF3F302F
Magika vba
Reporter FXOLabs
Tags:vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75891/
Detection(s):
SecuriteInfo.com.VBS.Generic.280.18196.19523.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm dropper evasive fingerprint masquerade powershell xworm
Link:
https://www.filescan.io/uploads/6a630db1d7a4dea5baa2086a/reports/7f395020-0c06-440c-ab04-bc0e473a020f/overview
Verdict:
Malicious
Labled as:
VBS/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30
Verdict:
Malicious
File Type:
vbs
First seen:
2026-07-24T01:29:00Z UTC
Last seen:
2026-07-26T05:33:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30/
Threat name:
Win32.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-07-24 04:31:10 UTC
File Type:
Binary
AV detection:
12 of 38 (31.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k53srwl6nzlp6oxms7tmqp4wysho7nihrw6og2gbjx2tevoip4ya._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/8e0668c5-f946-4a73-b9e4-1395c79f4ec0
Similar samples:
189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98
2b0109337f36f919de3158240ddbe58742707a58a769437b4243216e5c6c0a44
3d24c75606bfa91bca5fe783134d1b00a2bfb2dbc3da3f14044e172451e0e9b9
577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30
a21af048f2d0b53774660e7304581639c8027808b16ea9dd4bebd0af955124dc
b57acc8be12bf55e1f07666c4925ca786125c13c4e40fa6ad35f10314acba439
fe76289ae8c62c7d96679276437776085aa3789bd42f36ef7c57e24c91876942
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/260724-hs8jsseh89/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Executes a VBScript file via the Windows Script Host.
Badlisted process makes network request
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Visual Basic Script (vbs) vbs 577728d97e6e56ff3aec97e6c83f96c48eefb5078dbce368c14df53255c87f30

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/75891/

Comments