MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bcd7b55aedae9851b12c98228344807ba8df431fd2a3a5090a20662c5c95385. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments

SHA256 hash: 8bcd7b55aedae9851b12c98228344807ba8df431fd2a3a5090a20662c5c95385
SHA3-384 hash: 54b2e1fa6041a2bccb8d0b0e25d16b35f54f139d6022ad64bd3ddfe473df945f55059b21b0d4f8343cd9edd38d06747d
SHA1 hash: 068b138b47ac71598366dc74228b01a4b689db1c
MD5 hash: 74efc35a8b06d9d94ca1252c0f638f0b
humanhash: kentucky-bakerloo-freddie-mirror
File name:DeployingLibrary.vbs
Download: download sample
File size:15'079 bytes
First seen:2021-06-01 23:00:58 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 192:YoLzggVPfuOElbFP+eo1ZTDk5LZZVLBD9xui:YqJfEtCO7
TLSH AF62116E1DC863A7196D4A93FF48008C4E79D372A1356084FFB9C09C2D6941CEEC5AF6
Reporter rmceoin
Tags:vbs

Intelligence


File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Launching a process
Creating a process with a hidden window
Transferring files using the Background Intelligent Transfer Service (BITS)
DNS request
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Signature
Creates processes via WMI
Tries to download files via bitsadmin
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 427952 Sample: DeployingLibrary.vbs Startdate: 02/06/2021 Architecture: WINDOWS Score: 48 17 Tries to download files via bitsadmin 2->17 6 wscript.exe 2->6         started        9 bitsadmin.exe 1 2->9         started        11 bitsadmin.exe 1 2->11         started        process3 signatures4 19 Creates processes via WMI 6->19 13 conhost.exe 9->13         started        15 conhost.exe 11->15         started        process5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Behaviour
Download via BitsAdmin
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Visual Basic Script (vbs) vbs 8bcd7b55aedae9851b12c98228344807ba8df431fd2a3a5090a20662c5c95385

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments