MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 700df84ded9b9c5d9c4dc3ce258bd4db565916ae1dcc7c6c6b623421b718d5c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	700df84ded9b9c5d9c4dc3ce258bd4db565916ae1dcc7c6c6b623421b718d5c7
SHA3-384 hash:	b3fb22678c63b3d07864d8fe25f91bad304baaf81696c716b00797ce471d55d0cba5c3eaa91ae33922ff77eb65e89d1f
SHA1 hash:	0f5bca8cbf0a9ea8222e41a42801d40650394a7b
MD5 hash:	ed7ceffda5e148124e6b271de1c07fea
humanhash:	magazine-louisiana-lamp-october
File name:	2607306-05074.vbs
Download:	download sample
Signature	SiriusRAT Alert Create hunting rule
File size:	455'220 bytes
First seen:	2026-07-15 07:19:27 UTC
Last seen:	2026-07-20 09:43:29 UTC
File type:	vbs
MIME type:	text/plain
ssdeep	12288:CqXxCOS5ed2Wv+MxI+Ak8BGDix1OvqYU3HoWbyq+Dv:d8eMP+APBcB
TLSH	T12CA4D738BDEA602A71B3EE5D8ED47597E91FB663361ED81A009303464713AC2EDC163D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	abuse_ch
Tags:	SiriusRAT vbs

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

106

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/74734/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Agent-107.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a57349556bd89099b554ede

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a57348a2cffd0c6c7aeefc5/reports/8e6c58e9-a339-4f69-a380-84447933144a/overview

Hybrid Analysis VBS_Obfuscated_EI_trojan

Verdict:

Malicious

Labled as:

VBS_Obfuscated_EI_trojan

Link:

https://www.hybrid-analysis.com/sample/700df84ded9b9c5d9c4dc3ce258bd4db565916ae1dcc7c6c6b623421b718d5c7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-07-14T04:20:00Z UTC

Last seen:

2026-07-17T05:34:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/700df84ded9b9c5d9c4dc3ce258bd4db565916ae1dcc7c6c6b623421b718d5c7/results?tab=lookup

Joe Sandbox RDPWrap Tool, Clipboard Hijacker, Sirius

Result

Threat name:

RDPWrap Tool, Clipboard Hijacker, Sirius

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1942641

Signature

Contains functionality to hide user accounts

Contains functionality to start a terminal service

Creates an undocumented autostart registry key

Deletes shadow drive data (may be related to ransomware)

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Powershell scriptblock execution from environment variable

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to access browser extension known for cryptocurrency wallets

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected AntiVM3

Yara detected Clipboard Hijacker

Yara detected Generic Stealer

Yara detected RDPWrap Tool

Yara detected Sirius Rat

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/700df84ded9b9c5d9c4dc3ce258bd4db565916ae1dcc7c6c6b623421b718d5c7

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

T1059.005 VBScript

Link:

https://app.malva.re/file/ed7ceffda5e148124e6b271de1c07fea

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/700df84ded9b9c5d9c4dc3ce258bd4db565916ae1dcc7c6c6b623421b718d5c7/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oag7qtpntoof3hcnyphclc6u3nlfsfvodxghy3dlmi2cdnyy2xdq._file

Hatching Triage siriusrat

Result

Malware family:

siriusrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:siriusrat execution persistence rat

Link:

https://tria.ge/reports/260715-h5vtgahv4s/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Looks up external IP address via web service

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Detects SiriusRAT

Family: SiriusRAT

Malware Config

C2 Extraction:

133.18.107.191:4449

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.33

Link:

https://yomi.yoroi.company/submissions/700df84ded9b9c5d9c4dc3ce258bd4db565916ae1dcc7c6c6b623421b718d5c7

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/74734/