f55a7200661a7d991a2a77376e8f844d

VBScript

MD5: f55a7200661a7d991a2a77376e8f844d

Size: 616.8 KB

text/vbscript

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

VBScript file

Size

616.8 KB · 616,801 B

First seen

2026-08-28 14:00 · one month ago

Last seen

2026-08-28 14:00 · one month ago

Last analysis

2026-09-03 18:14 · one month ago

Hashes

MD5 f55a7200661a7d991a2a77376e8f844d Sha1 63976820668add4449087d855e0c0dd2541db889 Sha256 e68349059a419b9e563be28f5475d2bca0dcb5fdd2bacba28adf2f2f1ced266f Sha384 d1ea661ccc67cafadc7d97d6b803d95ecff448fcee2ac217b0680fc4c62fad2f659feceb1b3e7d8913862d43ab45dd88 Sha512 6aa2418cec49a88e1fe5539df507df8e7dc3e5cb97c932b94cfb29e4269bb9bd4cfe47b9837cd4defe5523b704d22600e34ce76e1f2bcb8d5f126be886d66398 SSDeep 96:2AqvaOc4YOrkZ+rQAzBMapjSUwZd+aBR+DiNvfAzY4EvISGEbcyx1boKKu9JaGxK:9raQBR+DEv3GVG4bo4ybhXZy TLSH 0BD4626115A20B244CBF6B8FA95871E3D80D75C3B345EB2D6E33F4DA12EBD4667018E2

Detection

Symbol obfuscation

Low

21 malicious · 22 files

VBSf55a7200661a7d991a2a77376e8f844d

VBSf55a7200661a7d991a2a77376e8f844d.deobfuscated.vbs

SH[Command #0]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:bat~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105

Shape scr:vbs>scr:bat>scr:ps1

malicious 3 nodes

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105

Shape scr:vbs>scr:ps1

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

21 malicious · 22 files

VBSf55a7200661a7d991a2a77376e8f844d

VBSf55a7200661a7d991a2a77376e8f844d.deobfuscated.vbs

SH[Command #0]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

f55a7200661a7d991a2a77376e8f844d

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

f55a7200661a7d991a2a77376e8f844d › f55a7200661a7d991a2a77376e8f844d.deobfuscated.vbs

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential