d3250c3b7421931920c36855ff6b2b0f

VBScript

MD5: d3250c3b7421931920c36855ff6b2b0f

Size: 26.31 MB

text/vbscript

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

VBScript file

Size

26.31 MB · 26,306,186 B

First seen

2026-08-26 08:00 · 2 months ago

Last seen

2026-08-26 08:00 · 2 months ago

Last analysis

2026-09-03 18:11 · one month ago

Hashes

MD5 d3250c3b7421931920c36855ff6b2b0f Sha1 e69b7514df8c06bf24ad51eb8d6a2079308017e5 Sha256 ae8874e0c30be45c84b9f1e97cfac409b06611650e4eadf2b07ab57e727ee65f Sha384 9586fae1c6438e6ad575f813c7b6ed114ceb8604a01982f2b2e15306065ad74a990bfdce946ad9f0237622835a98ec1b Sha512 75ec97dac8206981204c4f9981bedad813c1f6f0439c2c7ecda54d31e330d2426f56822a3ae01d0197afb9411d10a1067dee30cbc48ed34149ffe31ea56797e4 SSDeep 768:fuqkCCLPM6IBIRtGmCm2CyzPdJGjPViDsow:fuqkCKPM62IRtGmCbd8RJ TLSH BB4783E874A9485058369D9F122B38DBE65D0ECB3B92FB4C9C1BF9D0B107DB19B580D8

Detection

Symbol obfuscation

Low

21 malicious · 21 files

VBSd3250c3b7421931920c36855ff6b2b0f

VBSd3250c3b7421931920c36855ff6b2b0f.deobfuscated.vbs

SH[Command #0]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:bat~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105

Shape scr:vbs>scr:bat>scr:ps1

malicious 3 nodes

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105

Shape scr:vbs>scr:ps1

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

21 malicious · 21 files

VBSd3250c3b7421931920c36855ff6b2b0f

VBSd3250c3b7421931920c36855ff6b2b0f.deobfuscated.vbs

SH[Command #0]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

d3250c3b7421931920c36855ff6b2b0f

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

d3250c3b7421931920c36855ff6b2b0f › d3250c3b7421931920c36855ff6b2b0f.deobfuscated.vbs

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential