8ca0fc06be148ab0a35cdcd26b19e51e

VBScript

MD5: 8ca0fc06be148ab0a35cdcd26b19e51e

Size: 85.48 KB

text/vbscript

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

VBScript file

Size

85.48 KB · 85,483 B

First seen

2026-09-03 16:15 · one month ago

Last seen

2026-09-03 16:15 · one month ago

Last analysis

2026-09-03 18:17 · one month ago

Hashes

MD5 8ca0fc06be148ab0a35cdcd26b19e51e Sha1 bdd97d13d563b3b9614219cca1bdd4a5294cdd2e Sha256 b0c1031ea7d8f98db85e9461f660ceabd4a81ad8fef588498c8a1e34090fd1cb Sha384 2d52c6559f9ab311e37fef17cfa8471aa043ff598d2266686d82fd1807bfa7961d40134ae08f55158d3421d744efc986 Sha512 dc7031fefd104e39b55aa7a33e13b595712f6c2a85b0edf6434600a34585269189b1d01e166caf359f3c8397d2fb6a155ff287d62fd1ad7b2aa0fef6f689ca97 SSDeep 192:N8mMVc0HiXleRfRnZa3vQ4XGZ/lK3Ry4Z8dsOiAt/qYdYfNNgaF0cFBnmAHbQ:90whoMHk TLSH 7983BC3D6855C8B0B760895823CE50723C8D1E0353EEFFE9846B226CC179AF751A7967

Detection

Symbol obfuscation

Low

21 malicious · 22 files

VBS8ca0fc06be148ab0a35cdcd26b19e51e

VBS8ca0fc06be148ab0a35cdcd26b19e51e.deobfuscated.vbs

SH[Command #0]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:bat~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105

Shape scr:vbs>scr:bat>scr:ps1

malicious 3 nodes

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105

Shape scr:vbs>scr:ps1

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

21 malicious · 22 files

VBS8ca0fc06be148ab0a35cdcd26b19e51e

VBS8ca0fc06be148ab0a35cdcd26b19e51e.deobfuscated.vbs

SH[Command #0]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

Config. Field	Value
URL (COM trace) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

8ca0fc06be148ab0a35cdcd26b19e51e

URL in PowerShell #1 URImalicious

http:/huhuhuhuhuhuhuhuhuhuhu

8ca0fc06be148ab0a35cdcd26b19e51e › 8ca0fc06be148ab0a35cdcd26b19e51e.deobfuscated.vbs › [Command #0]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential