MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf7a39d4013473c81e9a6e8970bcc105fcbd08f64cab8e443b016bac151f3b17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cf7a39d4013473c81e9a6e8970bcc105fcbd08f64cab8e443b016bac151f3b17
SHA3-384 hash:	e16cf883837c15e1276d62e522f489e003274c8af50af74afb83a3c6ffbf84248356c7e1d8e5c6df1065134c2f0081c9
SHA1 hash:	3e76e578c43318d1ce877382d155bade73821242
MD5 hash:	e269f9aea70fda440c62f3d4b61a6f39
humanhash:	summer-johnny-montana-tennessee
File name:	paste.ee_d_toxScszg_scandalmongers.vbs
Download:	download sample
File size:	122'771 bytes
First seen:	2026-05-20 18:15:30 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	96:2MjAseMv/Co/Fl/fvCw/Fl/3//H/R//6V/V/Rg/BlCO/jV/fVCh/Fd/8lCj/Rg/R:2geEx7okcOilNRfk+nnnnO
TLSH	T170C3444976EAC3B5D88E8D4D9DADE68D284A0DE70FDCD158739A481ED1FC319E081FA0
Magika	vba
Reporter	TomU
Tags:	vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

36

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/66975/

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0e1bc14159ce11f601feed

Tags:

xtreme shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 evasive obfuscated powershell

Link:

https://www.filescan.io/uploads/6a0e0151861ee596e641c4c0/reports/8d32b056-cf12-4c63-90f6-115af986a7d5/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/cf7a39d4013473c81e9a6e8970bcc105fcbd08f64cab8e443b016bac151f3b17

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2025-05-22T17:53:00Z UTC

Last seen:

2025-06-11T10:18:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/cf7a39d4013473c81e9a6e8970bcc105fcbd08f64cab8e443b016bac151f3b17/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cf7a39d4013473c81e9a6e8970bcc105fcbd08f64cab8e443b016bac151f3b17

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf7a39d4013473c81e9a6e8970bcc105fcbd08f64cab8e443b016bac151f3b17/

ReversingLabs TitaniumCloud Script-WScript.Downloader.AsyncRAT

Threat name:

Script-WScript.Downloader.AsyncRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-22 17:30:15 UTC

File Type:

Binary

AV detection:

15 of 38 (39.47%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z55dtvabgrz4qhu2n2exbpgbax6l2chwjsvy4rb3afv2yfi7hmlq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260520-wwfj3saw2w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cf7a39d4013473c81e9a6e8970bcc105fcbd08f64cab8e443b016bac151f3b17

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

vbs cf7a39d4013473c81e9a6e8970bcc105fcbd08f64cab8e443b016bac151f3b17

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/66975/