11ef310699edc60864453c316caebd2d02c1052a664b7617b36277c755f1d6d5

Resubmissions

12/09/2026, 14:56

260912-sbdyzadd77

12/09/2026, 14:33

260912-rw4vfsdc386

Sharing

Copy URL Twitter E-mail

General

Target
ciao.vbs
Size 13B
Sample260912-rw4vfsdc38
SHA256 11ef310699edc60864453c316caebd2d02c1052a664b7617b36277c755f1d6d5
MD5 c22ad7523cc4021b3321783c71099cce
SHA1 f60ee827e76b825fb863fdaec4d0d6583900691c
SHA512 5dab4da0239a46a631be7e53899257f36d2e42aab36642a67c0dd6f28c9014f621c10d524a4c7e3c943c28941cecc893c5d5a3c4231e76b10f9951be4ffc5d03
MD5 SHA1 SHA512

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  ciao.vbs
- Size 13B
- SHA256 11ef310699edc60864453c316caebd2d02c1052a664b7617b36277c755f1d6d5
- MD5 c22ad7523cc4021b3321783c71099cce
- SHA1 f60ee827e76b825fb863fdaec4d0d6583900691c
- SHA512 5dab4da0239a46a631be7e53899257f36d2e42aab36642a67c0dd6f28c9014f621c10d524a4c7e3c943c28941cecc893c5d5a3c4231e76b10f9951be4ffc5d03
- MD5 SHA1 SHA512
Score

6^/10

discovery execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2