MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6e629c8375df83184401dd941ca2d490e78a1a338a9d0acdd43665b333cebfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c6e629c8375df83184401dd941ca2d490e78a1a338a9d0acdd43665b333cebfe
SHA3-384 hash:	2c09a0eeda288e9d781df5b6fb8048588969938eecb1112907207b4c53600e8d93d21f241b0e8b7b1f7c546140e34935
SHA1 hash:	614a816e66936f8bbde91d44b970e00b8b943a13
MD5 hash:	b173d873b2dcae93cd65e1e89ad80192
humanhash:	illinois-violet-network-river
File name:	payload.ps1
Download:	download sample
Signature	Gamaredon Alert Create hunting rule
File size:	103'443 bytes
First seen:	2025-11-23 17:39:20 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	1536:5m8xHYjhjHWhxKSwDOrCgQc1uG6McNCokHndB+VrtYYcG8QkeY:5m81Yj4hxKK8ecNKoX58Q1Y
TLSH	T14CA32A1AB45312A5C7293A87C6C3328BEBE89475353318D1B03598A71527C68FB9FD3D
Magika	vba
Reporter	M128BitOff
Tags:	apt gamaredon ps1 pteranodon Pterodo

M128BitOff

This malware sample was downloaded from Gamaredons Payload Delivery Infrastructure in the following analysis:
https://blog.synapticsystems.de/inside-gamaredon-2025-zero-click-espionage-at-scale/

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

39

Origin country :

FR

Vendor Threat Intelligence

ClamAV

Gathering data

CyberFortress

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c6e629c8375df83184401dd941ca2d490e78a1a338a9d0acdd43665b333cebfe

InQuest

Result

Gathering data

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c6e629c8375df83184401dd941ca2d490e78a1a338a9d0acdd43665b333cebfe

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

adodb.stream msxml2.domdocument.3.0 msxml2.xmlhttp Scripting.FileSystemObject VBScript vbscript.regexp WScript.Shell

Link:

https://app.malva.re/file/b173d873b2dcae93cd65e1e89ad80192

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c6e629c8375df83184401dd941ca2d490e78a1a338a9d0acdd43665b333cebfe/

Neiki Trojan.Win32.Agent

Verdict:

Malicious

Threat:

Trojan.Win32.Agent

Link:

https://tip.neiki.dev/file/c6e629c8375df83184401dd941ca2d490e78a1a338a9d0acdd43665b333cebfe

ReversingLabs TitaniumCloud Script-WScript.Trojan.Gamaredon

Threat name:

Script-WScript.Trojan.Gamaredon

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-23 17:40:30 UTC

File Type:

Text (VBS)

AV detection:

1 of 36 (2.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y3tctsbxlx4ddbcadxmudsrnjehhrindhcu5blg5intfwmz45p7a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/251123-v83ppsyrbz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.