391bc2949d267ef0a159b5b8350e68856fb0c24c3187e2420da9ce995ad8633c

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GuiConfigs/Old Steam by FlexBy.vbs
Size 30KB
Sample260916-pbecysar8s
SHA256 391bc2949d267ef0a159b5b8350e68856fb0c24c3187e2420da9ce995ad8633c
MD5 c9a53ca2b7cc6cbbcf130b4dad7b0429
SHA1 2e559c1385aa97717ec8ffa575540e37450bc706
SHA512 5adbf41d83172cc97bc17b1acddebc32766763fcf572fc8ceb9dd7444a0d842e25dc643f9ba19936c060f7f6a4be8d25b8d0d600acd33977c9d8efc8b45c2515
SSDEEP 768:6ag8ebqqaMSC3k7Z66ZevZbFgMpqupDdq:EJre6G
TLSH
T199E2DAB5EA865887333697397360C580F71653A3C9421B797FEDA3294F743B82836C89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1316	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\GuiConfigs\Old Steam by FlexBy.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads