Malicious
Malicious

0dccd2c6ca355c9f92d1626d8d046311

VBScript
MD5: 0dccd2c6ca355c9f92d1626d8d046311
Size: 7.61 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan

This sample is a 7.3 MB VBScript identified by Malva.RE as Stealer Crypter (stealer loader). It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1027.001, T1055 and T1140. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0008c95fb43bd97dec04c408b61a66a38f59a7912e4d4a058647ef14407463f2
MD5
0dccd2c6ca355c9f92d1626d8d046311
Verdict
Malicious
File type
VBScript · 7.3 MB
Family
Stealer Crypter
Category
Stealer Loader
MITRE ATT&CK
T1027T1027.001T1055T1140

Cite this report: https://app.malva.re/sha256/0008c95fb43bd97dec04c408b61a66a38f59a7912e4d4a058647ef14407463f2

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
7.61 MB · 7,613,440 B
First seen
2026-10-30 16:00 · 2 days ago
Last seen
2026-10-30 16:00 · 2 days ago
Last analysis
2026-10-30 16:00 · 2 days ago
Hashes
MD5 0dccd2c6ca355c9f92d1626d8d046311 Sha1 1868ce6a5039ceac2a956b0469fcf5322a285842 Sha256 0008c95fb43bd97dec04c408b61a66a38f59a7912e4d4a058647ef14407463f2 Sha384 49f6bd97892654bf296c24ab36e5d382335178edf9c4d38ad10895683beb1d8bd66f61508afdedb644aef2e0446d66fd Sha512 06ff5261aa3e41d942d07382a07a894169af3fe671b85c8ad46857f6e0f6c6cfefca7c26a623769f7831a5d1054b2fc968e2d1d82352a8c88a085aaf61398e2a SSDeep 49152:qX1I6BRs9Y/Id7CULk+jMDe6zyxnBWVldv9PZM2o2n7/f3yQ43y21SHMV2DWClN4:qlP2eUnjYvZjj7fyQ41YlLDCI3gEk TLSH DC764A07FC6549E9C0EEC5308AA69153BE713C496B3127D75B90F2242F32BE0ADB9758

1 malicious · 1 file
VBS0dccd2c6ca355c9f92d1626d8d046311Stealer Crypter
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1027.001~T1055~T1140
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. packe (entropie 6.57).

1 malicious · 1 file
VBS0dccd2c6ca355c9f92d1626d8d046311Stealer Crypter
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙