MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 faaadf20ba302f8f93cbd8c017b03a4c107eceebf862f1a4d692dfa947c057cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | faaadf20ba302f8f93cbd8c017b03a4c107eceebf862f1a4d692dfa947c057cb |
|---|---|
| SHA3-384 hash: | 2d0cf52c9746334dad257872e1af55a65310b221fca6074a6cbfccab6c0cbe247b2aa0815b9df356472488d97c4a5617 |
| SHA1 hash: | ae40bf697a1f06bcfe2711c2d0f3c0fc8fe98428 |
| MD5 hash: | eb2c906f9d0605c97522420bcf986026 |
| humanhash: | maryland-monkey-mars-cold |
| File name: | gupdate.vbs |
| Download: | download sample |
| File size: | 318 bytes |
| First seen: | 2025-09-29 08:02:30 UTC |
| Last seen: | Never |
| File type: |  vbs |
| MIME type: | text/plain |
| ssdeep | 6:ZDUUxPaH9JZMINKodChAVHikOLRD4NqheO2rmg83tuH1jCjsUC:yJGINKodoaCkOJhayV8VjMC |
| TLSH | T12AE0CD0A7D2DC622E0E5F655135551576EE8079D10285ABC0708508473509B553D55E7 |
| Magika | vba |
| Reporter |  smica83 |
| Tags: | UKR vbs |
Intelligence
File Origin
# of uploads :
1
# of downloads :
56
Origin country :
HUVendor Threat Intelligence
Detection:
n/a
Verdict:
Clean
Score:
99.9%
Tags:
n/a
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
persistence
Verdict:
Suspicious
Verdict:
Malicious
File Type:
vbs
First seen:
2025-09-24T05:34:00Z UTC
Last seen:
2025-09-24T05:34:00Z UTC
Hits:
~10
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.VBS.SAgent.gen
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Behaviour
Behavior Graph:
Score:
5%
Verdict:
Benign
File Type:
SCRIPT
Verdict:
Malware
YARA:
1 match(es)
Tags:
VBScript WScript.Shell
Verdict:
Malicious
Threat:
Trojan.JS.SAgent
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
6/10
Tags:
persistence
Behaviour
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
File information
The table below shows additional information about this malware sample such as delivery method and external references.
lnk vbs faaadf20ba302f8f93cbd8c017b03a4c107eceebf862f1a4d692dfa947c057cb
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.