MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecaaf6651becfa0901ce06fcb3ec0f933233cec66f41ab680ff42d1d9ffd06e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ecaaf6651becfa0901ce06fcb3ec0f933233cec66f41ab680ff42d1d9ffd06e2
SHA3-384 hash:	0127b82147d9f2f8ceb270372e0a89dc49900fbc3bdf0f5455b19d188018e959f6e111732692fe82fdcaa0e76ea5df35
SHA1 hash:	1699cc8e7a12a5c26f69d8157ddc05bf7926fca0
MD5 hash:	63a02673549906ceb1945b6503e586e2
humanhash:	speaker-winner-two-fourteen
File name:	Informazion.vbs
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	742 bytes
First seen:	2023-01-13 11:48:19 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/x-asm
ssdeep	12:tM7AmHvtmpYI+pWHMw4xyVoR8sTDqDB99hN4vACiXp8+l/JtyoW/Xjyon:tCPtu+pWHP4xyCR82DqDB99j44CSp3kL
TLSH	T1DB01CB69E455E363478FB053C124C82CEAB0B18A1BB7B3103340E59EA021B78D9648EF
Reporter	JAMESWT_WT
Tags:	agenziaentrate Gozi isfb testing Ursnif vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.VBS.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware packed shell32.dll stealer

Link:

https://www.filescan.io/uploads/63c14530de614a115a15fa44/reports/d96a1f68-56dd-4b1b-9a27-ae620989df0c/overview

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1151170

Signature

Benign windows process drops PE files

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (has network functionality)

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ecaaf6651becfa0901ce06fcb3ec0f933233cec66f41ab680ff42d1d9ffd06e2/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Minerva

Threat name:

Script-WScript.Trojan.Minerva

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-01-13 11:49:08 UTC

File Type:

Text (VBS)

AV detection:

10 of 26 (38.46%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5svpmzi35t5asaooa36lh3apsmzdhtwgn5a2w2ap6qwr3h75a3ra._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230113-rvqansdc8s/

Behaviour

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.76

Link:

https://yomi.yoroi.company/submissions/ecaaf6651becfa0901ce06fcb3ec0f933233cec66f41ab680ff42d1d9ffd06e2