MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a813cfc61c2b1c738d0c5785812dc28f461631a70d98b970fc9810f709dbd94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5a813cfc61c2b1c738d0c5785812dc28f461631a70d98b970fc9810f709dbd94
SHA3-384 hash:	6d316a5e96fd4a30af32d455184c30d2a68dd7e2dae29d4403ff7c353c8805fafbd654d5c86f525d230bd423a639af48
SHA1 hash:	4f2707cf3bc5216ab4e41265c00a9264edb3edd6
MD5 hash:	3e9ccaacccb792299a0b1c12b537817e
humanhash:	solar-venus-happy-mirror
File name:	Doc261124.vbs
Download:	download sample
Signature	VIPKeylogger Alert Create hunting rule
File size:	12'984 bytes
First seen:	2024-11-26 08:01:13 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:aeyyqW7XqvgA8ECXXgxQBWMb91LLf5yyfUeLwVwwybyYkpucH2gkSCXXZMnrMDPr:+IvYWgymMDPPmZOtBOWeu8GHRk8/
TLSH	T129429F16A3EA4608F2F31F29A87651684E37BE166D78D25D02AC580E0FF3E44D934B73
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	mp3
Reporter	abuse_ch
Tags:	vbs VIPKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

100

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67458080b31374f0983487f0

Tags:

xtreme gumen virus gates

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/674580840975a9df1ec13303/reports/bc2ba195-2beb-4ae7-8599-19cb0e151d45/overview

Hybrid Analysis Downloader/VBS.Generic

Verdict:

Suspicious

Labled as:

Downloader/VBS.Generic

Link:

https://www.hybrid-analysis.com/sample/5a813cfc61c2b1c738d0c5785812dc28f461631a70d98b970fc9810f709dbd94

Joe Sandbox Snake Keylogger, VIP Keylogger

Result

Threat name:

Snake Keylogger, VIP Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1562920

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Obfuscated command line found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Yara detected Powershell download and execute

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VBS Downloader Generic

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5a813cfc61c2b1c738d0c5785812dc28f461631a70d98b970fc9810f709dbd94

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5a813cfc61c2b1c738d0c5785812dc28f461631a70d98b970fc9810f709dbd94/

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-26 02:09:29 UTC

File Type:

Text (VBS)

AV detection:

4 of 24 (16.67%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lkatz7dbyky4oogqyv4fqew4fd2gcyy2odmyxfypzgaq64e5xwka._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/241126-jw5gzsslaw/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Malware Config

Dropper Extraction:

https://3105.filemail.com/api/file/get?filekey=shTPHbCPX8o-lOtCqHLG6_0xCy-xl4tnxlAVbQ95-dviTK5cARaNdQjbb3mexfwQzKmTXg&skipreg=true&pk_vid=e0109638c9bfb9571732531309b5ff7c

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5a813cfc61c2b1c738d0c5785812dc28f461631a70d98b970fc9810f709dbd94