Malicious
5b8aabbd46e1f2b72e85bc054ac431a2
VBScript
MD5: 5b8aabbd46e1f2b72e85bc054ac431a2
Size: 2.3 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
2.3 MB · 2,296,320 B
First seen
2026-10-09 09:30 · 16 days ago
Last seen
2026-10-09 09:30 · 16 days ago
Last analysis
2026-10-09 09:30 · 16 days ago
Hashes
MD5
5b8aabbd46e1f2b72e85bc054ac431a2
Sha1
a0aa425006cb152196796c049b804ad7a5016879
Sha256
f641ad3393b5f6ae3185ec897807caf55382793464c6182b03871ceaa7b24cf8
Sha384
027ddab062c6fb91bd3e0bb3bdf83c64c3b9586802f2245864c0c3296c95ee26f436e7cc86f26f29c4b3d39ae3e7b4a1
Sha512
0b2a89be5afceba15eed5000f8c2f7cdece628ccea42bcc3f626266db49bfcb0cc8be24e8af03b0dac3c1b5926bbb290282cb380d6e7876c5b335bc6aa5a556f
SSDeep
24576:pZhuprwmuJfDRakw/+V12lWQRgRnmBrXU9L8NIUWpR8yz//HqD:rhMPmfDNBCWVnmBQ98NI1Zz//Hi
TLSH
0DB54C2366D0204146B2A8FEBDBA5A37394F3C09612E954EFED35BD5E01D6B94C02E1F
8 malicious · 31 files
VBS5b8aabbd46e1f2b72e85bc054ac431a2T1027 · T1059.001 · T1059.005
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
VBS䌋䄱䜵䏾䕟㨦䔺䠑T1027 · T1059.005
VBS䌋䄱䜵䏾䕟㨦䔺䠑.deobfuscated.vbsT1059.005
BIN.executed
VBS.subscript.vbsT1059.005
VBS.subscript.vbs.deobfuscated.vbsT1059.005
PS1䌋䄱䜵䘾㵉㮪䐨䠽T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN䌋䄱䜵㵾㵶㧭䀝㸔㴫
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
BINozDEpxt3nXQC
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 3
STICH kept: 2secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
Path
ole:doc>scr:vbs~T1027~T1059.005
Shape
ole:doc>scr:vbs
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 31 files
VBS5b8aabbd46e1f2b72e85bc054ac431a2T1027 · T1059.001 · T1059.005
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
VBS䌋䄱䜵䏾䕟㨦䔺䠑T1027 · T1059.005
VBS䌋䄱䜵䏾䕟㨦䔺䠑.deobfuscated.vbsT1059.005
BIN.executed
VBS.subscript.vbsT1059.005
VBS.subscript.vbs.deobfuscated.vbsT1059.005
PS1䌋䄱䜵䘾㵉㮪䐨䠽T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN䌋䄱䜵㵾㵶㧭䀝㸔㴫
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
BINozDEpxt3nXQC
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
5b8aabbd46e1f2b72e85bc054ac431a2 › Root Entry › 䌋䄱䜵䏾䕟㨦䔺䠑
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
5b8aabbd46e1f2b72e85bc054ac431a2 › Root Entry › 䌋䄱䜵䏾䕟㨦䔺䠑 › 䌋䄱䜵䏾䕟㨦䔺䠑 › .executed › .subscript.vbs
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
5b8aabbd46e1f2b72e85bc054ac431a2 › Root Entry › 䌋䄱䜵䏾䕟㨦䔺䠑 › 䌋䄱䜵䏾䕟㨦䔺䠑 › .executed › .subscript.vbs
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
5b8aabbd46e1f2b72e85bc054ac431a2 › Root Entry › 䌋䄱䜵䏾䕟㨦䔺䠑 › 䌋䄱䜵䏾䕟㨦䔺䠑 › .executed › .subscript.vbs
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
5b8aabbd46e1f2b72e85bc054ac431a2 › Root Entry › 䌋䄱䜵䏾䕟㨦䔺䠑 › 䌋䄱䜵䏾䕟㨦䔺䠑 › .executed › .subscript.vbs
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
5b8aabbd46e1f2b72e85bc054ac431a2 › Root Entry › 䌋䄱䜵䏾䕟㨦䔺䠑 › 䌋䄱䜵䏾䕟㨦䔺䠑 › .executed › .subscript.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account