MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e1ea2c2951a63462b24371e3d13c4348e4615e85930924104ce6ea3b7f464d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2e1ea2c2951a63462b24371e3d13c4348e4615e85930924104ce6ea3b7f464d4
SHA3-384 hash:	a8e58f9f04006c1b2f24cb89f63655ef493ebcd6a413d93c4bed3ad1022f7e3ff047c21d87dcbeb096ef89e718c36c4e
SHA1 hash:	b530182e9c73a1bd0af038662169e373a8580402
MD5 hash:	13e0b1318f1a858854cc93292da65361
humanhash:	wyoming-wisconsin-mobile-white
File name:	6pcC7wQmpNB9icAWs.ps1
Download:	download sample
File size:	1'795'556 bytes
First seen:	2025-11-23 16:10:09 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3072:/u5dqRTdoAlkwu2Xbhl3owhmp0twnpVAXf09p9uWXdut7+RVpxRt3j3oKKCf0hIN:Er
TLSH	T109854C606EC64BC0297C47D269E36468CBDA69BAF6CA3C59128D4515304BFE0F1F4CBB
Magika	powershell
Reporter	aachum
Tags:	dropped-by-ACRStealer ps1

iamaachum

http://91.219.23.37/6pcC7wQmpNB9icAWs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

38

Origin country :

ES

Vendor Threat Intelligence

ClamAV

Gathering data

CyberFortress

Gathering data

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

crypt evasive powershell

Link:

https://www.filescan.io/uploads/692331f1eecb08e4aa45e755/reports/86ec5b9c-7358-4b59-ad8d-d1eed9ba7bf7/overview

Hybrid Analysis Trojan.PS.Agent

Verdict:

Suspicious

Labled as:

Trojan.PS.Agent

Link:

https://www.hybrid-analysis.com/sample/2e1ea2c2951a63462b24371e3d13c4348e4615e85930924104ce6ea3b7f464d4

InQuest

Result

Gathering data

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1819570

Signature

AI detected malicious Powershell script

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2e1ea2c2951a63462b24371e3d13c4348e4615e85930924104ce6ea3b7f464d4

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e1ea2c2951a63462b24371e3d13c4348e4615e85930924104ce6ea3b7f464d4/

Neiki Trojan.PowerShell.Agent

Verdict:

Malicious

Threat:

Trojan.PowerShell.Agent

Link:

https://tip.neiki.dev/file/2e1ea2c2951a63462b24371e3d13c4348e4615e85930924104ce6ea3b7f464d4

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fypkfquvdjrumkzeg4pd2e6egshemfpileyjeqiezzxkhn7umtka._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/251123-tmkrbsan2x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.