MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83
SHA3-384 hash:	44f4553352bc5c24338552503fb54f1c4d42cd2217203a0b0f9f626f84d3276b6b24135080eab953b16a7b1b2e2a63f2
SHA1 hash:	837691161e7506d0637eb7bc4e610768c944b267
MD5 hash:	b851f1488f5f0961077630bae1df687b
humanhash:	aspen-one-burger-zebra
File name:	gqJAhCTdxMg656.vbs
Download:	download sample
File size:	622 bytes
First seen:	2026-04-23 23:39:45 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	12:mqz92G2skV9vWdWjnbT4EXtyH4+CmRi+ChRi+C4i+2A2p9:l952zTAInbTdXtBmRwhRw42A2D
TLSH	T190F00201A31AC2E71212A2A604E4D55CE16049A46AF4B70A5510C84F075B87FF6CD1E6
Magika	vba
Reporter	BastianHein
Tags:	vbs

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/63398/

Detection(s):

SecuriteInfo.com.Script.SNH-gen.24728784.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69eaadfd51cce3ff702f77f6

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/69eaadf581aa9ec3bc229fcb/reports/72dade9a-6f14-4fa8-8145-1db9bcc03d68/overview

Verdict:

Suspicious

Labled as:

TR/SNH

Link:

https://www.hybrid-analysis.com/sample/62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83

Verdict:

Clean

File Type:

vbs

Link:

https://opentip.kaspersky.com/62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83/results?tab=lookup

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83

Verdict:

Malware

YARA:

1 match(es)

Tags:

ADODB.Stream Microsoft.XMLDOM MSXml2.DOMDocument.6.0 Scripting.FileSystemObject VBScript

Link:

https://app.malva.re/file/b851f1488f5f0961077630bae1df687b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83

Threat name:

Win32.Trojan.Runner

Status:

Suspicious

First seen:

2026-04-23 23:40:39 UTC

File Type:

Text (VBS)

AV detection:

9 of 38 (23.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mk5352tncml6qrdp3pbaldxc76gqs27ogejve3p45smcc4r4tkbq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/260423-3n6jvsax71/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/63398/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample