MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f73164bd4d2a475f79fb7d0806cfc3ddb510015f9161e7dce537d90956c11393. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f73164bd4d2a475f79fb7d0806cfc3ddb510015f9161e7dce537d90956c11393
SHA3-384 hash:	7004fd1be582e78eda1f732116d763ed325f9b9dc5f52fd8bb9036405226c727de65c0bea7a1a0e445f29b2ae9dfca44
SHA1 hash:	0aa097bc61e7201fe67d793615e1d561a1633158
MD5 hash:	ce4549607e46e656d8e019624d5036c1
humanhash:	hydrogen-cardinal-december-beryllium
File name:	1.vbs
Download:	download sample
Signature	KimJongRAT Alert Create hunting rule
File size:	4'975 bytes
First seen:	2025-06-18 13:07:19 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	48:9vRuv0bi67XYKd15c+adSBFJ2Mad5QNx0URh7wnAhSBPtOohu77R:9puM267oiBISBWMang3hVSu7R
TLSH	T18FA1CB071A343DEC91BF25676E535458C283DA1A3FB96472C92720711938AD83AC7EB6
Magika	vba
Reporter	JAMESWT_WT
Tags:	KimJongRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

75

Origin country :

IT

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/10025/

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6852ba2c8469b16a4d22395e

Tags:

ransomware virus

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f73164bd4d2a475f79fb7d0806cfc3ddb510015f9161e7dce537d90956c11393

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1717499

Signature

Bypasses PowerShell execution policy

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

37%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/f73164bd4d2a475f79fb7d0806cfc3ddb510015f9161e7dce537d90956c11393

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f73164bd4d2a475f79fb7d0806cfc3ddb510015f9161e7dce537d90956c11393/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Leonem

Threat name:

Script-WScript.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-16 19:37:21 UTC

File Type:

Text (VBS)

AV detection:

23 of 36 (63.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=64ywjpknfjdv66p3pueant6d3w2raak7sfq6pxhfg7mqsvwbcojq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/250618-qcycwsxqy3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f73164bd4d2a475f79fb7d0806cfc3ddb510015f9161e7dce537d90956c11393

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/10025/