Malicious
VBScript
MD5: 6059b95f1e9fc94eb3f7990005481871
Size: 77.42 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
77.42 KB · 77,421 B
First seen
2026-08-26 08:00 · 2 months ago
Last seen
2026-08-26 08:00 · 2 months ago
Last analysis
2026-09-03 18:11 · one month ago
Hashes
MD5
6059b95f1e9fc94eb3f7990005481871
Sha1
931bb78dce4ab4d8fbd95546e209c1bc32ccb031
Sha256
95d361da9317a7ec4ec5ec95011ff9cbdd5cafc53d851d73071c45cde88251a9
Sha384
3c93dca9cd99743719d03a1bf867fe6b7aef1e87bc6180b1ba94400b9671949e99d723f15478de8e254f329d8c0e89f6
Sha512
e481a632eb48f7a97e93b0ea5bb09e50ded31f5c765b7144edc72eac520c632a063c5af2b92a9118f51ff92514b6c83e9a4d808ff128717b3ee7aa19be82f0d4
SSDeep
768:BzDDUPs1S98lwbEMV4feKn1clvz62LI9439WnhsgQNje4J+4KB9k8YKaTY4PzEr:FP/wTva1eUiKCe
TLSH
63734F70F06982931C56A840EC499930CAF8299A7BB607F5C3E49FF6CFED1C265A57C1
Detection
Symbol obfuscation
Low
10 malicious · 10 files
VBS6059b95f1e9fc94eb3f7990005481871T1027 · T1059 · T1105
VBS6059b95f1e9fc94eb3f7990005481871.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential