Malicious
28521e66fb8d0f990ec326d90d7b4bdf
VBScript
MD5: 28521e66fb8d0f990ec326d90d7b4bdf
Size: 79.93 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
79.93 KB · 79,931 B
First seen
2026-08-26 08:00 · 2 months ago
Last seen
2026-08-26 08:00 · 2 months ago
Last analysis
2026-09-03 18:11 · one month ago
Hashes
MD5
28521e66fb8d0f990ec326d90d7b4bdf
Sha1
74baa73146d84da9f890e9576edc649340c87fe9
Sha256
ea3cc28c4ab73cceb9f0bb36267cb6ed4eb4bfe56cb31968b456e09fb82c3495
Sha384
8c6f0a893c489e61d320096a79abaa5f3f5056a19b7abee1d5d5fbf2822278f0c5abc660a378c6809626c78e2846464e
Sha512
4bbe4523cf2e95dfe629bd551726cb5f96273f07e98a576768829a1d431d74149b05733dee3c5e560ebc82690077150d35b1002f256bec7c280473e0ba3ab945
SSDeep
768:/zD4RX81uC2UAtxjXrkEfccWPdCrarL+tieIKF5madJkJJ8UHQlk19VMSxBLJFqx:7zA5UO14Xi8edZkaqBL3Al1
TLSH
B4733074F06882931C16A840EC499930CAF8359A7BB617F9C2E49FF6CFED1C265A57C1
Detection
Symbol obfuscation
Low
10 malicious · 10 files
VBS28521e66fb8d0f990ec326d90d7b4bdfT1027 · T1059 · T1105
VBS28521e66fb8d0f990ec326d90d7b4bdf.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential10 malicious · 10 files
VBS28521e66fb8d0f990ec326d90d7b4bdfT1027 · T1059 · T1105
VBS28521e66fb8d0f990ec326d90d7b4bdf.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
28521e66fb8d0f990ec326d90d7b4bdf
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
28521e66fb8d0f990ec326d90d7b4bdf › 28521e66fb8d0f990ec326d90d7b4bdf › .executed › .subscript.vbs
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
28521e66fb8d0f990ec326d90d7b4bdf › 28521e66fb8d0f990ec326d90d7b4bdf › .executed › .subscript.vbs › .subscript.vbs.deobfuscated.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
28521e66fb8d0f990ec326d90d7b4bdf › 28521e66fb8d0f990ec326d90d7b4bdf › .executed › .subscript.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
28521e66fb8d0f990ec326d90d7b4bdf › 28521e66fb8d0f990ec326d90d7b4bdf › .executed › .subscript.vbs › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account