🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a
SHA3-384 hash: 717b0cc358edaf25b924a62c7140b141a3b300ffbc66f70709fa4912a1d4081ec8ee9abe3e39e7ee8a9583b9f0018562
SHA1 hash: abbb21e18971ea3f7e2a122930c0dde03d6f0cf7
MD5 hash: 61ebb9d109593afa040a63de887d71ef
humanhash: charlie-alanine-music-nuts
File name:31agosto.vbs
Download: download sample
File size:3'349'321 bytes
First seen:2026-07-24 22:48:52 UTC
Last seen:2026-07-25 02:35:45 UTC
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 49152:iXQ/Pj/wIkXDv2aStTY06o/vNKT9OOlu1rQZ4cbf:s
TLSH T189F51203AE06E88A0DAC857F38734FF97D6A781122F91CC2C3A4B1994155FD1CDA97B6
Magika vba
Reporter abuse_ch
Tags:vbs

Intelligence

File Origin
# of uploads :
3
# of downloads :
96
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76007/
Detection(s):
SecuriteInfo.com.Script.SNH-gen.46925923.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
encrypted evasive obfuscated obfuscated powershell
Link:
https://www.filescan.io/uploads/6a63ec023d14ecaf0d8778e4/reports/5c9639b0-4bc6-46b5-8ed9-cff929e999d2/overview
Verdict:
Suspicious
Labled as:
DR/SNH
Link:
https://www.hybrid-analysis.com/sample/916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a
Verdict:
Malicious
File Type:
vbs
First seen:
2026-07-24T20:26:00Z UTC
Last seen:
2026-07-25T13:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1947861
Signature
AI detected malicious Powershell script
Antivirus / Scanner detection for submitted sample
Bypasses PowerShell execution policy
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a
Verdict:
Malware
YARA:
2 match(es)
Tags:
Base64 Block Contains Base64 Block DeObfuscated Obfuscated PowerShell T1027 T1059.001 T1059.005 VBScript
Link:
https://app.malva.re/file/61ebb9d109593afa040a63de887d71ef
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a/
Threat name:
Win32.Dropper.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-24 22:49:51 UTC
File Type:
Text (VBS)
AV detection:
9 of 38 (23.68%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sfv5drbpbshgpyniubt5ioy2ph3kvseqyp43mhusb6fa2gusfana._file
Verdict:
malicious
Label(s):
EvolutionRAT
Create hunting rule
Link:
https://reports.threatray.com/71a81a32-df23-4184-8294-e260bbdf1e38
Similar samples:
0eba8dc5391d1b249389f0d5fbaefa07ae696bb661d81ff25c7e6c04776792ba
1f5e9d142982853d02067c066c2329aa0077ea72d8d8b61f0afe6b6ec1b0c050
2e79d9e29de2e654d1eeeb640250f618beb5573c9889067ae173138e5ee00d3f
517520d23f9c6f2cb32c4387f69aecdbf6f2ec9c98b5ac42e89e45d1cfdccffc
637430a438550bcf9799d0a25b442c8d9937336a1fff812d5d05f006d191ce86
7583d3cfebe8bdda892a43b63ce3806f4f5dae3d9e4a9d5b8f3f80be13d83ab0
ab2df544db70a9af9ae70572c5eab2ec213a0e03544dca643719729f55f518c4
d1949808be6639961f35ce7386c041fbdd57bf021d5bcd7c2b9d8c0728222d64
f1c55cbe1c6f840091aa44c4ecf58003915890a9ac834407fa3c4c77c4267709
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution
Link:
https://tria.ge/reports/260724-2rzeaavsgt/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Visual Basic Script (vbs) vbs 916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3626699/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/76007/

Comments