MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f467084343ca7986a188108390c1de3c98bb211e304cc4bc700125c1ea495f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7f467084343ca7986a188108390c1de3c98bb211e304cc4bc700125c1ea495f6
SHA3-384 hash:	d4d1dc3534efec126e3375b405c95485f7ce98dac7c05e29168540bdea4b47b6eb5059c7938aadf4a8fcd9623523486d
SHA1 hash:	eb2c18ca27cf1395a5c7eb174c5064357c9106bb
MD5 hash:	8f235f4138a3362a67caee9ff82a4fc4
humanhash:	wyoming-december-maine-friend
File name:	dropped.ps
Download:	download sample
Signature	Gamaredon Alert Create hunting rule
File size:	93'630 bytes
First seen:	2025-11-23 15:47:22 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	1536:4Khmo2ewfPpcf1JltcSk5rRKspUiUd9lGneYeOKVq8j1SKg553NqgXh886jh67wG:ElpWJlIaZlGnrGI8j1s553NOh67n
TLSH	T17D933B17F80312E4971A7293C2C7228BDEE4C4757A361491F13598AB251BC79EB8FA3D
Magika	vba
Reporter	M128BitOff
Tags:	apt dropper gamaredon powershell ps1

M128BitOff

This malware sample was downloaded from Gamaredons Payload Delivery Infrastructure in the following analysis:
https://blog.synapticsystems.de/inside-gamaredon-2025-zero-click-espionage-at-scale/

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

26

Origin country :

FR

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69233506a59c70c97d6a07c0

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive masquerade obfuscated

Link:

https://www.filescan.io/uploads/692334feeecb08e4aa45e934/reports/1bb1e90d-47c9-4fb5-ae24-9aa88579f8e0/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7f467084343ca7986a188108390c1de3c98bb211e304cc4bc700125c1ea495f6

InQuest

Result

Gathering data

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7f467084343ca7986a188108390c1de3c98bb211e304cc4bc700125c1ea495f6

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

adodb.stream msxml2.domdocument.3.0 msxml2.xmlhttp Scripting.FileSystemObject VBScript vbscript.regexp WScript.Shell

Link:

https://app.malva.re/file/8f235f4138a3362a67caee9ff82a4fc4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f467084343ca7986a188108390c1de3c98bb211e304cc4bc700125c1ea495f6/

Neiki Trojan-Downloader.VBS.SLoad

Verdict:

Malicious

Threat:

Trojan-Downloader.VBS.SLoad

Link:

https://tip.neiki.dev/file/7f467084343ca7986a188108390c1de3c98bb211e304cc4bc700125c1ea495f6

ReversingLabs TitaniumCloud Script-WScript.Trojan.Gamaredon

Threat name:

Script-WScript.Trojan.Gamaredon

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-23 16:23:25 UTC

File Type:

Text (VBS)

AV detection:

1 of 36 (2.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p5dhbbbuhstzq2qyqeedsda54peyxmqr4mcmys6haajfyhvesx3a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/251123-tvzkfsylhx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.