neverban_zBbnJe.vbs

Communicates with host for which no DNS query was performed (1 event)

host	66.42.63.27

Wscript.exe initiated network communications indicative of a script based payload download (1 event)

Time & API	Arguments	Status	Return	Repeated
WSASend Sept. 26, 2023, 6:16 p.m.	buffer: POST /wztvqgsw HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 0 Host: 66.42.63.27:2351 socket: 500		0	0

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

ESET-NOD32	a variant of Generik.FRLABCZ
TrendMicro-HouseCall	Trojan.JS.DARKGATE.YXDITZ
Avast	Script:SNH-gen [Trj]
TrendMicro	Trojan.JS.DARKGATE.YXDITZ
Ikarus	Trojan.SuspectCRC
Microsoft	Trojan:Script/Wacatac.B!ml
Google	Detected
Rising	Trojan.Undefined!8.1327C (TOPIS:E0:qW3ulbDPjXU)
Fortinet	VBS/Agent.SJR!tr.dldr
AVG	Script:SNH-gen [Trj]

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
WSASend Sept. 26, 2023, 6:16 p.m.	buffer: POST /wztvqgsw HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 0 Host: 66.42.63.27:2351 socket: 500		0	0