Malicious
2bae3ea0bc0c6c56753ffdfb5eb277cd
VBScript
MD5: 2bae3ea0bc0c6c56753ffdfb5eb277cd
Size: 2.94 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
2.94 KB · 2,942 B
First seen
2026-10-21 12:16 · 4 days ago
Last seen
2026-10-21 12:16 · 4 days ago
Last analysis
2026-10-21 12:16 · 4 days ago
Hashes
MD5
2bae3ea0bc0c6c56753ffdfb5eb277cd
Sha1
7f2ce5ff40be78bfd6c8d26166b8b23d81aacc3b
Sha256
7646da181b16f9b9ca8f0961edba5f6e51ed66686beb33240d288d8617accce6
Sha384
48cbc2012a06d77b4eb83ee3e38b472701efe5dbf8cd0f52d71b06eebbe39407b4c1a8cd0f130c60818196a0913ef6fb
Sha512
60699cf2a1a0b1743aef89ad8842e49fc925ccee305f98053ea76ac85421a125c76d246c3c9e808e8623f1b34b1d12495f99dea01c9bc341e8d1aebbcd9aa4cd
SSDeep
48:ECcBKP1r0Pheh/IwWw0YcKjqZcUA7ba4+8rZGTIi+crBajZa1PeHsw:/cIP1r0ehFEYcKjCMU8rZGTUak/Hsw
TLSH
84513417FD1BE8715E277371E2C548148CFEA22768154856BB4CCE6C4F1157CE6F0A62
Detection
Symbol obfuscation
Medium
2 malicious · 2 files
VBS2bae3ea0bc0c6c56753ffdfb5eb277cdT1027 · T1059 · T1105
VBS2bae3ea0bc0c6c56753ffdfb5eb277cd.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005~T1105
Shape
scr:vbs
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCommand (COM trace) #1
UNKNWOWNmalicious
msiexehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential2 malicious · 2 files
VBS2bae3ea0bc0c6c56753ffdfb5eb277cdT1027 · T1059 · T1105
VBS2bae3ea0bc0c6c56753ffdfb5eb277cd.deobfuscated.vbsT1059.005
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCommand (COM trace) #1
UNKNWOWNmalicious
msiexehuhuhuhuhuhuhuhuhuhuhu
2bae3ea0bc0c6c56753ffdfb5eb277cd
Dropped path (COM trace) #1
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
2bae3ea0bc0c6c56753ffdfb5eb277cd
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
2bae3ea0bc0c6c56753ffdfb5eb277cd
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
2bae3ea0bc0c6c56753ffdfb5eb277cd
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
2bae3ea0bc0c6c56753ffdfb5eb277cd
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
2bae3ea0bc0c6c56753ffdfb5eb277cd
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account