ScreenShot
| Created | 2023.09.26 18:19 | Machine | s1_win7_x6403_us |
| Filename | neverban_zBbnJe.vbs | ||
| Type | ASCII text, with very long lines, with CRLF line terminators | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 10 detected (a variant of Generik, FRLABCZ, DARKGATE, YXDITZ, Wacatac, Detected, Undefined, TOPIS, qW3ulbDPjXU) | ||
| md5 | 08cbb6ece8ee6238c20a24691b0c6855 | ||
| sha256 | 7b83d3665f2829f45f8df4ff87b8adc3bc62b6c617df1184c795d61015d40cd3 | ||
| ssdeep | 24:6ULiOERxpeuowwS+cVAgrs0vhcqR0xuJhEvIr+LpswiQ4jvel/CPcXcTScdw:6e1EFp7TzNrZhJR0xuAJiQIYKDhw | ||
| imphash | |||
| impfuzzy | |||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| watch | Communicates with host for which no DNS query was performed |
| watch | File has been identified by 10 AntiVirus engines on VirusTotal as malicious |
| watch | Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe |
| watch | Wscript.exe initiated network communications indicative of a script based payload download |
Rules (0cnts)
| Level | Name | Description | Collection |
|---|
