MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ad4fd0c0b88ab0d825bcd3d5bea86232dbebbf41f0b3b8de78d5c77eb2de9c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8ad4fd0c0b88ab0d825bcd3d5bea86232dbebbf41f0b3b8de78d5c77eb2de9c6
SHA3-384 hash:	0d7f540d2b6a8b68b60cfa15aa9390eaa0d51b33576d7c19bf113cba1826530413a11dd9f801c78deaf174ab7796f886
SHA1 hash:	3ef2f7246e9dee40ca9b6a7ecc0b5c7568367e80
MD5 hash:	3dd859f7aa6f95b80aae2c7c4b5eaaf9
humanhash:	mike-eleven-low-oscar
File name:	client_3.vbs
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	23'407 bytes
First seen:	2023-10-05 16:46:31 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	384:GOjk+QtGIKg7ETp2FHIKIGZVgXFpmcMYqYaGmPUVdE/MMMWm4qVuAL:I9eYjTT//0MjgVuAL
TLSH	T13CB27D6D034FA8F89773ACC88AD5AC53FB74872A4A2CC6C49F30FEEA2414574A4E551D
Reporter	JAMESWT_WT
Tags:	agenziaentrate Gozi isfb Ursnif vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

164

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.6021.19084.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/8ad4fd0c0b88ab0d825bcd3d5bea86232dbebbf41f0b3b8de78d5c77eb2de9c6

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1320445

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Contains functionality to modify clipboard data

Encrypted powershell cmdline option found

PowerShell case anomaly found

Powershell drops PE file

Suspicious powershell command line found

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8ad4fd0c0b88ab0d825bcd3d5bea86232dbebbf41f0b3b8de78d5c77eb2de9c6/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-05 14:13:36 UTC

File Type:

Text (VBS)

AV detection:

6 of 23 (26.09%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rlkp2dalrcvq3as3zu6vx2ugemw35o7ud4ftxdphrvohp2zn5hda._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/231005-vahxmseg34/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Blocklisted process makes network request

Malware Config

Dropper Extraction:

http://communicalink.com/index.php

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8ad4fd0c0b88ab0d825bcd3d5bea86232dbebbf41f0b3b8de78d5c77eb2de9c6