MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1454c4c2b513ca1a536a6f0da2f9a1ec6a1a33d258413efd4a1105215aeccbe7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1454c4c2b513ca1a536a6f0da2f9a1ec6a1a33d258413efd4a1105215aeccbe7
SHA3-384 hash:	f2669267b94b6598edee20dafaed839f327611e29cb8b20e6590a473c9b3af6564ff99d90f186e29c55f14cf8e1c6532
SHA1 hash:	23213695582515a5fdf4c42fb9e182e77e01acaa
MD5 hash:	cf3f9dbbb8366d853f3283d151e7e096
humanhash:	december-fourteen-football-uncle
File name:	qpzuwtw.bmp.ps
Download:	download sample
Signature	Gamaredon Alert Create hunting rule
File size:	2'465 bytes
First seen:	2025-11-23 15:48:39 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	48:/vuLbL0o6NONj5QZLITFgj5ppA2tsLAkANgASXV6ZgWDWxDaSsDIuxDaSsDMuxDb:HuLbL0o6NONj5QBITFgj5ppQXXJV6ijR
TLSH	T1A15166437E37536281EAB312B191104BDECA931621AA6564369CE8102FD796CD1F82FF
Magika	vba
Reporter	M128BitOff
Tags:	apt gamaredon powershell ps1

M128BitOff

This malware sample was downloaded from Gamaredons Payload Delivery Infrastructure in the following analysis:
https://blog.synapticsystems.de/inside-gamaredon-2025-zero-click-espionage-at-scale/

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

20

Origin country :

FR

Vendor Threat Intelligence

ClamAV

Gathering data

CyberFortress

Gathering data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fingerprint lolbin masquerade schtasks

Link:

https://www.filescan.io/uploads/692334fc5d3feebe12d835f0/reports/8b718f95-a175-45cc-8a96-59f191a28abe/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1454c4c2b513ca1a536a6f0da2f9a1ec6a1a33d258413efd4a1105215aeccbe7

InQuest

Result

Gathering data

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/1454c4c2b513ca1a536a6f0da2f9a1ec6a1a33d258413efd4a1105215aeccbe7

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated Obfuscated Scripting.FileSystemObject T1059.005 VBScript WScript.Shell

Link:

https://app.malva.re/file/cf3f9dbbb8366d853f3283d151e7e096

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1454c4c2b513ca1a536a6f0da2f9a1ec6a1a33d258413efd4a1105215aeccbe7/

Neiki Trojan-Ransom.Win32.Encoder

Verdict:

Malicious

Threat:

Trojan-Ransom.Win32.Encoder

Link:

https://tip.neiki.dev/file/1454c4c2b513ca1a536a6f0da2f9a1ec6a1a33d258413efd4a1105215aeccbe7

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=crkmjqvvcpfbuu3kn4g2f6nb5rvbum6slbat57kkcecscwxmzptq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/251123-tvzkfsylhy/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.