MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614
SHA3-384 hash:	3389f930019fd40a56c46d51b5042494950e39c6a37422381f8b654f2673964cd9cc894fd5c4a8432bdda616e96dafcd
SHA1 hash:	efffd334bc264432c90a05af80415d957fc9d4e7
MD5 hash:	dfe645499a02162be32241d148fc99ce
humanhash:	princess-whiskey-five-blossom
File name:	Route_Dims&Commodity details.vbs
Download:	download sample
File size:	88'492 bytes
First seen:	2026-05-19 17:47:15 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:d1TlbFPwXGt3pjkMqBpn4hykb9bsBEnE6EH/30ZnfY2Ebt2dUG:dxxFzm32LmwnfYLAdUG
Threatray	1'029 similar samples on MalwareBazaar
TLSH	T188831416FA9F8414B2B25A4B5E93F1B54BBF391A2DBC884910CCAB474BD3A40D4117BF
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	Anonymous
Tags:	vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

122

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/66469/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Agent-CCL.94789562.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0ca2594f2b29ce04016700

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 obfuscated powershell powershell

Link:

https://www.filescan.io/uploads/6a0ca23cefbd399b39bbd7fe/reports/b7767c10-3c47-46c3-8c19-72132cfa8417/overview

Hybrid Analysis VBS/Agent.COK

Verdict:

Malicious

Labled as:

VBS/Agent.COK

Link:

https://www.hybrid-analysis.com/sample/c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-05-19T11:45:00Z UTC

Last seen:

2026-05-20T18:46:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.PowerShell.Generic HEUR:Trojan-Downloader.Script.Generic PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/dfe645499a02162be32241d148fc99ce

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614/

Neiki Trojan.JS.SAgent

Verdict:

Malicious

Threat:

Trojan.JS.SAgent

Link:

https://tip.neiki.dev/file/c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614

ReversingLabs TitaniumCloud Script-WScript.Trojan.Znyonm

Threat name:

Script-WScript.Trojan.Znyonm

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-19 15:06:41 UTC

File Type:

Text (VBS)

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y63n5v5riils6hturnkbyhd5hptvoocnqd3pqdfuladqaam7oyka._file

Threatray njrat

Verdict:

malicious

Label(s):

njrat

Alert

Create hunting rule

Similar samples:

0c03726da1db8d0821887d390b619db49556d3630dc1f93da577f622c0d092bf

76310c2b5ba91a2a728c81063e0b1ef3745f8d7f30f5f042800ab512d4296fba

926ba0cd4bbc68a20f282481aaf4426238820c1a57dcf74fe0bbcef57b018625

a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5

b18c9f23c532dea5deda70b03b8441beba067907dc09864310a8b8d2449bc388

b6f3ca45b91abcf36da7f3233065170ea55a65a03aa8baa62ee0801a480ceb6b

e463226cbb26f2a9248dc8f40434bfadd2e718b5477d000414e32bcecc6900eb

e5090bf88e382f6a4db66fd00a5d730fa509b2279d4573bb54204c432ad619e7

error

fb1014e6aed7d7d17d8fb0bbbd7f4cea944c045d3215aedcffa80304a56ed20e

+ 1'019 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution

Link:

https://tria.ge/reports/260519-wda7mshz8w/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Indicator Removal: File Deletion

.NET Reactor proctector

Checks computer location settings

Drops startup file

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/66469/