🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7701a62b2fe48ae9a2d183a23c4c8567d3fe6834a24c7798ec9d25f98b537faa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7701a62b2fe48ae9a2d183a23c4c8567d3fe6834a24c7798ec9d25f98b537faa
SHA3-384 hash: 2ed9351b8d0f6ea113a07d31ea7e66ed74f472dd9f626473ead12240c5f9ebeeaed14d7d5342495239d807f3c3ea950d
SHA1 hash: 6e155f5bd79954d7649020ce4b09a1455b9203aa
MD5 hash: 7d5c559a3527d00b0e04aa4540674f42
humanhash: georgia-saturn-kentucky-nuts
File name:RateSheet.wsf
Download: download sample
File size:245 bytes
First seen:2026-09-29 18:20:45 UTC
Last seen:Never
File type:wsf WSF
MIME type:text/html
ssdeep 3:M5BUO9KNvFF/jKAlYFFEm8nm//tFgBgSSJJFIGFfgTXY2mbSKXofAEyOGNR+WOGV:LTu3NqW/Es8GFdXofAEz+R+WqDWl4PU
TLSH T14CD09703DC29C44F0B4BA8628135E80CAB88481140E0EAADBFC0F94C0BDA3E58B91016
Magika txt
Reporter smica83
Tags:wsf

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection(s):
PUA.Win.Trojan.Script-44
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ace3a2d350c7ee8cc14fb6d
Tags:
trojan agent shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/6abc019e9663063376cf3658/reports/e985a282-5a92-41bc-bb51-b6967566001f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/7701a62b2fe48ae9a2d183a23c4c8567d3fe6834a24c7798ec9d25f98b537faa
Verdict:
Malicious
File Type:
wsf
First seen:
2026-09-30T09:24:00Z UTC
Last seen:
2026-09-30T18:16:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7701a62b2fe48ae9a2d183a23c4c8567d3fe6834a24c7798ec9d25f98b537faa/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1979652
Signature
Antivirus detection for URL or domain
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Powershell connects to network
Powershell drops PE file
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1979652 Sample: RateSheet.wsf Startdate: 29/09/2026 Architecture: WINDOWS Score: 100 66 airport.adam-46c.workers.dev 2->66 68 tool.ncsgo.workers.dev 2->68 70 5 other IPs or domains 2->70 86 Suricata IDS alerts for network traffic 2->86 88 Malicious sample detected (through community Yara rule) 2->88 90 Antivirus detection for URL or domain 2->90 92 3 other signatures 2->92 10 wscript.exe 1 2->10         started        13 wscript.exe 2->13         started        15 svchost.exe 1 1 2->15         started        signatures3 process4 dnsIp5 100 VBScript performs obfuscated calls to suspicious functions 10->100 102 Wscript starts Powershell (via cmd or directly) 10->102 104 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->104 106 Suspicious execution chain found 10->106 18 powershell.exe 14 19 10->18         started        108 WScript reads language and country specific registry keys (likely country aware script) 13->108 23 node.exe 13->23         started        84 127.0.0.1 unknown unknown 15->84 signatures6 process7 dnsIp8 72 airport.adam-46c.workers.dev 104.21.40.88, 49699, 80 CLOUDFLARENET-CloudflareIncUS Canada 18->72 62 C:\Users\user\AppData\...\tt45ry4t.zco.exe, PE32 18->62 dropped 94 Powershell connects to network 18->94 96 Powershell drops PE file 18->96 25 tt45ry4t.zco.exe 14 11 18->25         started        30 conhost.exe 18->30         started        74 dns.google 8.8.8.8, 443, 49716 GOOGLE-GoogleLLCUS United States 23->74 76 23.94.252.63, 49718, 49824 DEDIK-IODEDIKSERVICESLIMITEDDEDIKIOGB United States 23->76 78 3 other IPs or domains 23->78 98 Suspicious powershell command line found 23->98 32 cmd.exe 23->32         started        34 powershell.exe 23->34         started        36 powershell.exe 23->36         started        38 conhost.exe 23->38         started        file9 signatures10 process11 dnsIp12 80 nodejs.org 104.16.213.131, 443, 49701 CLOUDFLARENET-CloudflareIncUS Canada 25->80 82 tool.ncsgo.workers.dev 172.67.219.7, 443, 49700 CLOUDFLARENET-CloudflareIncUS Canada 25->82 64 C:\Users\user\AppData\Local\...\launcher.vbs, Unicode 25->64 dropped 110 Multi AV Scanner detection for dropped file 25->110 112 Uses schtasks.exe or at.exe to add and modify task schedules 25->112 40 schtasks.exe 1 25->40         started        42 tar.exe 1001 25->42         started        44 schtasks.exe 25->44         started        52 2 other processes 25->52 46 tasklist.exe 32->46         started        48 conhost.exe 34->48         started        50 conhost.exe 36->50         started        file13 signatures14 process15 process16 54 conhost.exe 40->54         started        56 conhost.exe 42->56         started        58 conhost.exe 44->58         started        60 conhost.exe 52->60         started       
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/7701a62b2fe48ae9a2d183a23c4c8567d3fe6834a24c7798ec9d25f98b537faa
Verdict:
Malware
YARA:
4 match(es)
Tags:
COM Behavior Trace DeObfuscated Html Obfuscated T1027 T1059.005 VBScript WScript.Shell WSF File
Link:
https://app.malva.re/file/7d5c559a3527d00b0e04aa4540674f42
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7701a62b2fe48ae9a2d183a23c4c8567d3fe6834a24c7798ec9d25f98b537faa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4a2mkzp4sfotiwrqordytefm7j742buujghpghmtus7tc2tp6va._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260929-wzfdgsvz5p/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Discovers running processes
Executes a VBScript file via the Windows Script Host.
Enumerates connected drives
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7701a62b2fe48ae9a2d183a23c4c8567d3fe6834a24c7798ec9d25f98b537faa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments