Malicious
Malicious

61ebb9d109593afa040a63de887d71ef

VBScript
MD5: 61ebb9d109593afa040a63de887d71ef
Size: 3.35 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
PowerShell Script
Size
3.35 MB · 3,349,321 B
First seen
2026-07-24 23:01 · 3 months ago
Last seen
2026-07-24 23:01 · 3 months ago
Last analysis
2026-07-26 05:08 · 3 months ago
Hashes
MD5 61ebb9d109593afa040a63de887d71ef Sha1 abbb21e18971ea3f7e2a122930c0dde03d6f0cf7 Sha256 916bd1c42f0c8e67e1a8a067d43b1a79f6aac890c3f9b61e920f8a0d1a92281a Sha384 7211c090706d7b7bf8d7c71fc7fe0016c2b1df68b79bd9510bcebe2823852ed5067af408292676e5e92845db388fda1d Sha512 4eb2c315b0d6fdeb7a470b5a7266168a3a29e18ed33d398385c3dfde6180066937170e6206720db7fc24ceb60237e7cd8b81e5043bdaba95343d8ce841720a6a SSDeep 49152:iXQ/Pj/wIkXDv2aStTY06o/vNKT9OOlu1rQZ4cbf:s TLSH 89F51203AE06E88A0DAC857F38734FF97D6A781122F91CC2C3A4B1994155FD1CDA97B6
5 malicious · 6 files
VBS61ebb9d109593afa040a63de887d71ef
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BIN[Base64-Block]
VBS61ebb9d109593afa040a63de887d71ef.deobfuscated.vbs
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:ps1
malicious 2 nodes
5 malicious · 6 files
VBS61ebb9d109593afa040a63de887d71ef
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BIN[Base64-Block]
VBS61ebb9d109593afa040a63de887d71ef.deobfuscated.vbs
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙