Malicious
be96efa7aeaddc0d0a9445dabe62ca8e
VBScript
MD5: be96efa7aeaddc0d0a9445dabe62ca8e
Size: 83.59 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
83.59 KB · 83,588 B
First seen
2026-08-31 08:45 · one month ago
Last seen
2026-08-31 08:45 · one month ago
Last analysis
2026-09-03 18:14 · one month ago
Hashes
MD5
be96efa7aeaddc0d0a9445dabe62ca8e
Sha1
7382432592f6c31bb3ad75382307e02818abc4de
Sha256
b54378e29cdea0b95f1dd513269b16af061d1e4a40162dd8b71e19796237cc27
Sha384
f25f671dc413fd781d3c558b919e266a6eec6cdd1a613eaa95a49eceaab6d1a4e06efbaae31c569f3a4a9c6c99a1fb2e
Sha512
e6a2b2449dd41b9d2dfe2c826d9a0a32869ad6d1cbcc847fee27c1074af77fe90d75e61de072fddec7141078346c0c733c9bd057f50c6874d907d18408f578ee
SSDeep
1536:/oR57nFL+sW4ArOFg91Aym1lXnVRqughe5fIQkhpHbplZbLBRc54+/xBziwQIDs3:tRd
TLSH
E28372682244D0C3ABC53710F8EBBFE4A1647AE6BDDC478050244A51D7ADEE79C90B9F
Detection
Symbol obfuscation
Low
10 malicious · 10 files
VBSbe96efa7aeaddc0d0a9445dabe62ca8eT1027 · T1059 · T1105
VBSbe96efa7aeaddc0d0a9445dabe62ca8e.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential10 malicious · 10 files
VBSbe96efa7aeaddc0d0a9445dabe62ca8eT1027 · T1059 · T1105
VBSbe96efa7aeaddc0d0a9445dabe62ca8e.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
be96efa7aeaddc0d0a9445dabe62ca8e
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
be96efa7aeaddc0d0a9445dabe62ca8e › be96efa7aeaddc0d0a9445dabe62ca8e › .executed › .subscript.vbs
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
be96efa7aeaddc0d0a9445dabe62ca8e › be96efa7aeaddc0d0a9445dabe62ca8e › .executed › .subscript.vbs › .subscript.vbs.deobfuscated.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
be96efa7aeaddc0d0a9445dabe62ca8e › be96efa7aeaddc0d0a9445dabe62ca8e › .executed › .subscript.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
be96efa7aeaddc0d0a9445dabe62ca8e › be96efa7aeaddc0d0a9445dabe62ca8e › .executed › .subscript.vbs › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account