🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da
SHA3-384 hash: d259e9aaa820bb93b73b711fdea22a1ca248064c1d31c0ff32dc92b6e383774d118804e4e9187d02e4bfe41979b0fc43
SHA1 hash: 419e6f244421dcb509ba6804f40a03f8e731afc0
MD5 hash: f39210e509964b26ccb1e3688236160e
humanhash: mockingbird-colorado-apart-pennsylvania
File name:wpzhnwksxkx.vbs
Download: download sample
File size:14'235 bytes
First seen:2026-05-11 13:48:07 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:BwQc1evRN1WWefMqn2bJLY+nlMt5n66fS/wFkucwqjDPS:XtpvWOCRtCY
TLSH T12E524C9A0BCFC5F8D33BEC8485D99C43EB9AC2261B2DD286DF663DA52025C6CE0F5454
Magika vba
Reporter smica83
Tags:vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/65612/
Detection(s):
SecuriteInfo.com.Script.SNH-gen.76199281.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a01df18832827cdb620d1b5
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
encrypted obfuscated obfuscated
Link:
https://www.filescan.io/uploads/6a01de1ddf14f1cb2acffed5/reports/d4d359ec-32c5-4a52-bd24-a40273dd7fcb/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da
Verdict:
Malicious
File Type:
vbs
First seen:
2026-05-11T10:55:00Z UTC
Last seen:
2026-05-12T08:00:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Agent.sb Trojan-Downloader.VBS.SLoad.sb Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan.Script.Generic HEUR:Trojan.MSIL.Dnoper.gen Trojan.VBS.SAgent.sb Trojan.JS.SAgent.sb Trojan-Downloader.JS.SLoad.sb HEUR:Trojan-Downloader.Script.Generic Trojan.MSIL.Dnoper.sb
Link:
https://opentip.kaspersky.com/fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1911669
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Benign windows process drops PE files
Bypasses PowerShell execution policy
Creates multiple autostart registry keys
Drops VBS files to the startup folder
Encrypted powershell cmdline option found
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: Drops script at startup location
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Register Wscript In Run Key
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: WScript or CScript Dropper
System process connects to network (likely due to code injection or exploit)
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected Costura Assembly Loader
Yara detected Generic JS Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1911669 Sample: wpzhnwksxkx.vbs Startdate: 11/05/2026 Architecture: WINDOWS Score: 100 71 ndigitals.in 2->71 73 www.ristorantezago.it 2->73 75 5 other IPs or domains 2->75 87 Sigma detected: Register Wscript In Run Key 2->87 89 Malicious sample detected (through community Yara rule) 2->89 91 Antivirus detection for URL or domain 2->91 93 8 other signatures 2->93 8 wscript.exe 15 2->8         started        13 ProtectEvaluate.exe 15 7 2->13         started        15 wscript.exe 2->15         started        17 4 other processes 2->17 signatures3 process4 dnsIp5 77 ndigitals.in 68.66.200.215, 443, 49681 A2HOSTINGUS United States 8->77 59 C:\Users\user\AppData\...\rad1CF32.tmp.exe, PE32+ 8->59 dropped 109 System process connects to network (likely due to code injection or exploit) 8->109 111 Benign windows process drops PE files 8->111 113 VBScript performs obfuscated calls to suspicious functions 8->113 115 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->115 19 rad1CF32.tmp.exe 1 6 8->19         started        79 smartheartboardgame.com 162.244.93.4, 443, 49691, 49692 PONYNETUS United States 13->79 81 vothequine.com 192.95.19.213, 443, 49700, 49701 OVHFR Canada 13->81 83 3 other IPs or domains 13->83 61 C:\Users\user\Documents\...\vammbx3wfon.vbs, ASCII 13->61 dropped 63 C:\Users\user\AppData\...\jmt1ecvk1ij.vbs, ASCII 13->63 dropped 117 Creates multiple autostart registry keys 13->117 23 powershell.exe 13->23         started        25 powershell.exe 13->25         started        27 powershell.exe 13->27         started        35 4 other processes 13->35 65 C:\Users\user\AppData\...\rad65000.tmp.exe, PE32+ 15->65 dropped 119 WScript reads language and country specific registry keys (likely country aware script) 15->119 29 rad65000.tmp.exe 15->29         started        67 C:\Users\user\AppData\...\radD08C8.tmp.exe, PE32+ 17->67 dropped 69 C:\Users\user\AppData\...\rad8FA62.tmp.exe, PE32+ 17->69 dropped 31 radD08C8.tmp.exe 17->31         started        33 rad8FA62.tmp.exe 17->33         started        file6 signatures7 process8 file9 57 C:\Users\user\AppData\...\ProtectEvaluate.exe, PE32+ 19->57 dropped 95 Multi AV Scanner detection for dropped file 19->95 97 Creates multiple autostart registry keys 19->97 37 ProtectEvaluate.exe 1 19->37         started        40 svchost.exe 1 1 19->40         started        99 Loading BitLocker PowerShell Module 23->99 43 conhost.exe 23->43         started        45 conhost.exe 25->45         started        47 conhost.exe 27->47         started        49 conhost.exe 35->49         started        51 conhost.exe 35->51         started        53 conhost.exe 35->53         started        55 conhost.exe 35->55         started        signatures10 process11 dnsIp12 101 Multi AV Scanner detection for dropped file 37->101 103 Drops VBS files to the startup folder 37->103 105 Encrypted powershell cmdline option found 37->105 107 Bypasses PowerShell execution policy 37->107 85 127.0.0.1 unknown unknown 40->85 signatures13
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da/
Verdict:
Malicious
Threat:
Trojan-Downloader.JS.SLoad
Link:
https://tip.neiki.dev/file/fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-11 13:48:26 UTC
File Type:
Text (VBS)
AV detection:
10 of 38 (26.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ta2xvasfrfkn5xxoiwx2oyjhok25oco42lshgly4yqbvkem6tna._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/260511-q38xbaey6m/
Behaviour
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/65612/

Comments