MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af2ddbb1342c32efb23134f2a40d1ad390e85f57296c3dee753c99f867fc0ef2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	af2ddbb1342c32efb23134f2a40d1ad390e85f57296c3dee753c99f867fc0ef2
SHA3-384 hash:	0c513628c188fbfc33e467052c9958dfd1cc3172158317089e3feafbc13ac3e1f55f89e5e27e6743341aff152fc82c7d
SHA1 hash:	0c12c4e502b2b4f7787d37beefe45e3136e8c4cc
MD5 hash:	1c1280469329139b25a57f2894e4a034
humanhash:	crazy-charlie-undress-freddie
File name:	A-7.21Ո.vbs
Download:	download sample
Signature	RemCom Alert Create hunting rule
File size:	361'574 bytes
First seen:	2026-07-21 05:52:34 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	384:cpMpQEkr4yK//E2iTqbQiQ/myKyA7QbKygdhm0gqZkW/U6POm4ixh4WW0AQXXOL0:h
TLSH	T12F74AF19371D7862B276212F4D3D9E2396E1F19DA702CAD06208FF787DE95C3AB10678
Magika	vba
Reporter	abuse_ch
Tags:	RemCom vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

83

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/75486/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.27935989.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5f0947bcffb2c48cb7a7db

Tags:

obfuscate xtreme shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm encrypted evasive fingerprint

Link:

https://www.filescan.io/uploads/6a5f093851b920655dc49745/reports/b27d74c0-5596-42e8-9a06-9659cbdc703e/overview

Hybrid Analysis GT:VB.ObfDldr.31

Verdict:

Malicious

Labled as:

GT:VB.ObfDldr.31

Link:

https://www.hybrid-analysis.com/sample/af2ddbb1342c32efb23134f2a40d1ad390e85f57296c3dee753c99f867fc0ef2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-07-20T20:44:00Z UTC

Last seen:

2026-07-21T02:53:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/af2ddbb1342c32efb23134f2a40d1ad390e85f57296c3dee753c99f867fc0ef2/results?tab=lookup

Joe Sandbox RemCom RemoteAdmin

Result

Threat name:

RemCom RemoteAdmin

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1945634

Signature

Benign windows process drops PE files

Bypasses PowerShell execution policy

Changes security center settings (notifications, updates, antivirus, firewall)

Drops or copies certutil.exe with a different name (likely to bypass HIPS)

Drops PE files with benign system names

Enables network access during safeboot for specific services

Installs new ROOT certificates

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Performs DNS queries to domains with low reputation

Potential context-aware VBS script found (checks for environment specific values)

Potential malicious VBS script found (suspicious strings)

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Set custom UserAgent and download file via Powershell

Sigma detected: Suspicious Ping/Del Command Combination

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (Installed program check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses powercfg.exe to modify the power settings

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes or reads registry keys via WMI

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/af2ddbb1342c32efb23134f2a40d1ad390e85f57296c3dee753c99f867fc0ef2

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated Obfuscated T1027 T1059.005 VBScript

Link:

https://app.malva.re/file/1c1280469329139b25a57f2894e4a034

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/af2ddbb1342c32efb23134f2a40d1ad390e85f57296c3dee753c99f867fc0ef2/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-21 02:44:47 UTC

File Type:

Text (VBS)

AV detection:

3 of 36 (8.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v4w5xmjufqzo7mrrgtzkidi22oioqx2xffwd33tvhsm7qz74b3za._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution persistence spyware trojan

Link:

https://tria.ge/reports/260721-gk9lfsht8z/

Behaviour

Checks SCSI registry key(s)

Gathers system information

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Executes a command shell one-liner

Modifies trusted root certificate store through registry

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Drops file in Program Files directory

Drops file in Windows directory

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

Checks installed software on the system

Enumerates connected drives

Hide Artifacts: Hidden Window

Power Settings

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/af2ddbb1342c32efb23134f2a40d1ad390e85f57296c3dee753c99f867fc0ef2

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/75486/