MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa26b956edc6d25f5aeff7cd7e9db28c70ea730b03b90246c6dc9f93d6db062b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	aa26b956edc6d25f5aeff7cd7e9db28c70ea730b03b90246c6dc9f93d6db062b
SHA3-384 hash:	4a88ca9babb2cd1ffc4c023872327c4e5b832da1282b20846da5c1936a1a137b30a4a86b50388af24e6ebacdf669022d
SHA1 hash:	ab63c6a4add37ca3756fd6a104e72af8d578e736
MD5 hash:	f0f046309448cc6adcb032e1c33e9671
humanhash:	sierra-gee-burger-early
File name:	incrustado.vbs
Download:	download sample
File size:	113'900 bytes
First seen:	2025-06-17 06:05:33 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:iDi5H/CZor5RU9wtXGzZq3W5Qay58faKaIBEfEMW34wVEKnwsCTLbg9VVy6xUmv5:iDi5H/CZomqKzVEKntyo9hxUmleC3N
TLSH	T1E9B363C79E0BC760413246E39C2B989EEA44407B9261D11CFC4CE4E16F3FBD5AD646EA
Magika	vba
Reporter	abuse_ch
Tags:	vbs

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/9789/

Gathering data

Verdict:

Malicious

Labled as:

TrojanDownloader/VBS.Maloader

Link:

https://www.hybrid-analysis.com/sample/aa26b956edc6d25f5aeff7cd7e9db28c70ea730b03b90246c6dc9f93d6db062b

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1716135

Signature

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Score:

17%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/aa26b956edc6d25f5aeff7cd7e9db28c70ea730b03b90246c6dc9f93d6db062b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa26b956edc6d25f5aeff7cd7e9db28c70ea730b03b90246c6dc9f93d6db062b/

Threat name:

Script-WScript.Downloader.RemcosRAT

Status:

Malicious

First seen:

2025-06-17 01:49:29 UTC

File Type:

Text (VBS)

AV detection:

9 of 24 (37.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vitlsvxny3jf6wxp67gx5hnsrryou4ylao4qerwg3spzhvw3ayvq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/250617-gt4fssdr7v/

Behaviour

Blocklisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aa26b956edc6d25f5aeff7cd7e9db28c70ea730b03b90246c6dc9f93d6db062b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.