MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e514e7e47fd7b1ddc7c58e62dae3fe09e6cdc2897a91ddd512dc399e616a7528. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e514e7e47fd7b1ddc7c58e62dae3fe09e6cdc2897a91ddd512dc399e616a7528
SHA3-384 hash:	31f10e91375b583d9c8465cab01e517094e70ccf16f6042a972f47eed6eb24ff53222fdcb4250e48643d2b48006220b5
SHA1 hash:	9cf8211d1d3049cc8b7f8d7e37f48027df8d90e6
MD5 hash:	5beeacd15f4ec3fb45398d0c66b6f9bb
humanhash:	early-cardinal-march-enemy
File name:	PO#50426.vbs
Download:	download sample
File size:	14'799'964 bytes
First seen:	2026-05-07 05:50:43 UTC
Last seen:	2026-05-08 10:35:17 UTC
File type:	vbs
MIME type:	text/csv
ssdeep	3072:Jzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzs:+
TLSH	T195E6CF63B96502DDF1D95A1C5C9BE70E3321BD93F929AC1B7F846B7E5E33908083A901
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	lowmal3
Tags:	vbs

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

18

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-05-07T00:29:00Z UTC

Last seen:

2026-05-08T20:38:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/e514e7e47fd7b1ddc7c58e62dae3fe09e6cdc2897a91ddd512dc399e616a7528/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1910734

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Bypasses PowerShell execution policy

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Environment Variable Has Been Registered

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows Shell Script Host drops VBS files

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected MSIL Injector

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud

Gathering data

VMRay Remcos

Malware family:

Remcos

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e514e7e47fd7/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.