🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95bdcbf0b40186b2c92e16a419cfd676aa9a4812bdf1fdc89a29859ea4a9bc7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95bdcbf0b40186b2c92e16a419cfd676aa9a4812bdf1fdc89a29859ea4a9bc7e
SHA3-384 hash: aaa4029735f92c5a400c6f365fef40003e9c55311fe74bde1d11dddefdd856e9bd68a087563d2986fb4f5feff7bd2d0b
SHA1 hash: e4ba6b26b53a4080cd668406d42af365b2300683
MD5 hash: 35a7b6e56649f250f748cb451fdff3f9
humanhash: montana-cat-beer-island
File name:01_nofullcomments.vbs
Download: download sample
File size:3'753'181 bytes
First seen:2026-11-01 04:24:35 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 49152:xBxPuDaztxwADT6fJX+VHSUffDHhqljkhr506mNgGTilKd4HbTouyhTn1L8ip:htbDT6fJlUfcljmr506mNgGT8bTozL8+
TLSH T1E9062932BEA712B4136B959EBA0600297CD67803D2031850FFDE45392B4FE9896DE77D
Magika vba
Reporter bilel

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
DZ DZ
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96453/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae6dbc9b175ade21dcee02e
Tags:
vmdetect cobalt
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/95bdcbf0b40186b2c92e16a419cfd676aa9a4812bdf1fdc89a29859ea4a9bc7e
Verdict:
Malicious
File Type:
vbs
First seen:
2026-11-02T19:56:00Z UTC
Last seen:
2026-11-03T00:19:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/95bdcbf0b40186b2c92e16a419cfd676aa9a4812bdf1fdc89a29859ea4a9bc7e/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1995987
Signature
Accesses sensitive object manager directories (likely to detect virtual machines)
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Benign windows process drops PE files
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to detect virtual machines (IN, VMware)
Deletes itself after installation
Multi AV Scanner detection for dropped file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Generic JS Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1995987 Sample: 01_nofullcomments.vbs Startdate: 01/11/2026 Architecture: WINDOWS Score: 100 48 qmlab1.com 2->48 50 ip-api.com 2->50 56 Antivirus detection for URL or domain 2->56 58 Yara detected Generic JS Downloader 2->58 60 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->60 62 5 other signatures 2->62 10 wscript.exe 1 2->10         started        signatures3 process4 signatures5 76 Benign windows process drops PE files 10->76 78 Wscript starts Powershell (via cmd or directly) 10->78 80 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->80 82 3 other signatures 10->82 13 wscript.exe 24 10->13         started        18 wscript.exe 10->18         started        20 wscript.exe 10->20         started        22 4 other processes 10->22 process6 dnsIp7 52 qmlab1.com 66.11.126.50, 443, 49711 TIER-NET-TierNetTechnologiesLLCUS United States 13->52 54 ip-api.com 208.95.112.1, 49710, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 13->54 46 C:\Users\user\AppData\Local\...\katyusha.exe, PE32 13->46 dropped 84 System process connects to network (likely due to code injection or exploit) 13->84 86 Wscript starts Powershell (via cmd or directly) 13->86 88 Deletes itself after installation 13->88 90 3 other signatures 13->90 24 katyusha.exe 13->24         started        28 cmd.exe 1 13->28         started        30 cmd.exe 1 13->30         started        file8 signatures9 process10 file11 44 C:\Users\user\AppData\Local\Temp\v32.dll, PE32 24->44 dropped 64 Multi AV Scanner detection for dropped file 24->64 66 Contains functionality to detect virtual machines (IN, VMware) 24->66 68 Contains functionality to detect hardware virtualization (CPUID execution measurement) 24->68 70 Accesses sensitive object manager directories (likely to detect virtual machines) 24->70 32 conhost.exe 24->32         started        72 Wscript starts Powershell (via cmd or directly) 28->72 74 Adds a directory exclusion to Windows Defender 28->74 34 powershell.exe 23 28->34         started        36 conhost.exe 28->36         started        38 powershell.exe 37 30->38         started        40 conhost.exe 30->40         started        signatures12 process13 process14 42 WmiPrvSE.exe 34->42         started       
Score:
19%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/95bdcbf0b40186b2c92e16a419cfd676aa9a4812bdf1fdc89a29859ea4a9bc7e
Verdict:
Malware
YARA:
2 match(es)
Tags:
COM Behavior Trace DeObfuscated Obfuscated SOS: 0.26 T1027 T1059.005 VBScript
Link:
https://app.malva.re/file/35a7b6e56649f250f748cb451fdff3f9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95bdcbf0b40186b2c92e16a419cfd676aa9a4812bdf1fdc89a29859ea4a9bc7e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sw64x4fuagdlfsjoc2sbtt6wo2vjusasxxy73se2fgcz5jfjxr7a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution upx
Link:
https://tria.ge/reports/261101-g7v2ksg15z/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies registry class
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Direct Volume Access: Opens a physical disk for reading
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Checks for VirtualBox DLLs, possible anti-VM trick
Executes a VBScript file via the Windows Script Host.
UPX packed file
Looks up external IP address via web service
Checks computer location settings
Deletes itself
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/95bdcbf0b40186b2c92e16a419cfd676aa9a4812bdf1fdc89a29859ea4a9bc7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/96453/

Comments