Malicious
026aafda7e95d736cfad8c959705e681
VBScript
MD5: 026aafda7e95d736cfad8c959705e681
Size: 82.23 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
82.23 KB · 82,226 B
First seen
2026-08-26 13:30 · 2 months ago
Last seen
2026-08-26 13:30 · 2 months ago
Last analysis
2026-09-03 18:11 · one month ago
Hashes
MD5
026aafda7e95d736cfad8c959705e681
Sha1
625007df3a834c9260a1d1343560810d79b7a82d
Sha256
ac199868947a0a71f0c65390de2b6dc041a12aeb51f52487e2b753a2652c8919
Sha384
04ce939d5e30aff43ffb13458d5c531ad0ad889a872bb1237d61e6a8a4714496df5505ecce95b31e187f1d92a31aeeae
Sha512
c1c77211bb4cef0a2ea059c3b7b6679089b31067b3f474c3ac8e11c64eea2e3907a65d1dff6a4991a324c0e1cd17733df5e7c7d2883a90d103916cb89ad4dba3
SSDeep
768:SzGvT66cphiXCHRvd/KMmOBCi8U1L1VrROkBBuDSrOmhG4WlplMhsBhbwgULJ1Td:CicrICxv4gfVBPluvwD
TLSH
A4834F74F06882931C56A840EC499D30CAF8259A7EB517FAC2E49FF2CFED5C225A57C1
Detection
Symbol obfuscation
Low
10 malicious · 10 files
VBS026aafda7e95d736cfad8c959705e681T1027 · T1059 · T1105
VBS026aafda7e95d736cfad8c959705e681.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential10 malicious · 10 files
VBS026aafda7e95d736cfad8c959705e681T1027 · T1059 · T1105
VBS026aafda7e95d736cfad8c959705e681.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
026aafda7e95d736cfad8c959705e681
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
026aafda7e95d736cfad8c959705e681 › 026aafda7e95d736cfad8c959705e681 › .executed › .subscript.vbs
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
026aafda7e95d736cfad8c959705e681 › 026aafda7e95d736cfad8c959705e681 › .executed › .subscript.vbs › .subscript.vbs.deobfuscated.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
026aafda7e95d736cfad8c959705e681 › 026aafda7e95d736cfad8c959705e681 › .executed › .subscript.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
026aafda7e95d736cfad8c959705e681 › 026aafda7e95d736cfad8c959705e681 › .executed › .subscript.vbs › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account