Malicious
VBScript
MD5: 74fdfe5410f03f96cd088f8bf4f541b5
Size: 16.94 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
16.94 KB · 16,940 B
First seen
2026-08-31 18:45 · one month ago
Last seen
2026-08-31 18:45 · one month ago
Last analysis
2026-09-03 18:17 · one month ago
Hashes
MD5
74fdfe5410f03f96cd088f8bf4f541b5
Sha1
929ba101a3113c4731c14c18d2ddc8d4e42b5c7b
Sha256
15a11d2eba905d86669a3eb2cf96ef4f1e007c73d19681d302ea65d460676e4e
Sha384
f4a4c2a56d7616a269ce8aeb07529c646603da81bbea89fddfa025706238b16fd42934d375fe8fa80cbca881810c1a64
Sha512
049e2c8949137944a0d3517578876d5a114abcc80ded887ae50ea0d60be51f7ebd012bf366931e4f2a378ff1cf719bcf9bf60dbea3b9df229d0a0c573eb0658b
SSDeep
384:83DVAaVTEbJ58wCk7RKEjw4K1ijT57aHakIumYAeOPJyODXa5DVvk:oVAaV4fBRKN4K1umUAvk
TLSH
8672C91CEDC53CF450398EB05AA4E4B9A9BFB214D0CD4A69F8F28F504C664D738245DE
Detection
Symbol obfuscation
Very high
2 malicious · 2 files
VBS74fdfe5410f03f96cd088f8bf4f541b5T1027 · T1059 · T1105
VBS74fdfe5410f03f96cd088f8bf4f541b5.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005~T1105
Shape
scr:vbs
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #4 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #6 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #7 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #8 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #9 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #10 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #11 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #12 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #13 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #14 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #15 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #16 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCommand (COM trace) #1
UNKNWOWNmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #2
UNKNWOWNmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #2
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #3
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #4
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #5
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #6
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #7
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #8
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #9
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #10
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #11
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #12
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #13
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 9huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential