MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bdcf094575b9f2a3cf09586535edc5aa899d16e9058f04f57b7b25f3844ded7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6bdcf094575b9f2a3cf09586535edc5aa899d16e9058f04f57b7b25f3844ded7
SHA3-384 hash:	48c501f3678e6ecc976df2ed1a9d1b910508dfdf8ce90b517a984f2ee3935ed4e738d037ddecd374112e6192ac6af5d2
SHA1 hash:	33127f9237b1b616d97f5724d0c6b40be1c20f63
MD5 hash:	c066ff078204e3dcf52d066b3461a146
humanhash:	jig-glucose-wolfram-leopard
File name:	Docx_rws_02.vbs
Download:	download sample
File size:	3'052 bytes
First seen:	2026-02-18 12:14:22 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	48:PkA+nvI8RWWa4841gBppYXEPBz/d9G4P4hJ780Arp4orUyrsgdd0C71RAf7LKYa0:WnvwBTxPV/KR7CrUkHYV
TLSH	T1FE51129FAF098330ED61434ACA17AE1BE7F9146E5510D17439EAD0097B2336CD6E50CB
Magika	vba
Reporter	juroots
Tags:	vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

69

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6995add31ebe863df485224f

Tags:

infosteal spawn

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive lolbin msiexec wscript

Link:

https://www.filescan.io/uploads/6995ad6d10e80629d4e8916c/reports/89c8dff1-8917-4744-8556-7331f59a6f2d/overview

Hybrid Analysis VBS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

VBS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/6bdcf094575b9f2a3cf09586535edc5aa899d16e9058f04f57b7b25f3844ded7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

Detections:

HEUR:Trojan.VBS.SAgent.gen Trojan.JS.SAgent.sb not-a-virus:HEUR:RemoteAdmin.VBS.Alien.gen

Link:

https://opentip.kaspersky.com/6bdcf094575b9f2a3cf09586535edc5aa899d16e9058f04f57b7b25f3844ded7/results?tab=lookup

Nucleon Malprob Benign

Score:

18%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/6bdcf094575b9f2a3cf09586535edc5aa899d16e9058f04f57b7b25f3844ded7

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6bdcf094575b9f2a3cf09586535edc5aa899d16e9058f04f57b7b25f3844ded7/

Neiki RemoteAdmin.VBS.Alien

Verdict:

Malicious

Threat:

RemoteAdmin.VBS.Alien

Link:

https://tip.neiki.dev/file/6bdcf094575b9f2a3cf09586535edc5aa899d16e9058f04f57b7b25f3844ded7

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-18 00:29:32 UTC

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=npopbfcxlopsuphqswdfgxw4lkujtulosbmpat2xw6zf6oce33lq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/260218-t128jaes2b/

Behaviour

Script User-Agent

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.