MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0100602572ed6cc62ab77ef3d413ce303f058fe8f3309718005d0c740d1735fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 2

Intelligence 2 IOCs YARA 3 File information Comments

SHA256 hash:	0100602572ed6cc62ab77ef3d413ce303f058fe8f3309718005d0c740d1735fa
SHA3-384 hash:	8dbc2b3376ccf9a43946cbe1555cc86add237b53fda5170dffd396f40246f43d26c8a5d6068b9f465d403eb84e8dc666
SHA1 hash:	62a238d869897e189878e63ac3aa4c7a0007079d
MD5 hash:	5ffd94ce67a6a6fe2c9c1fc9beeb8211
humanhash:	kilo-cold-bakerloo-virginia
File name:	payload2.ps1
Download:	download sample
File size:	20'578 bytes
First seen:	2026-04-13 17:07:28 UTC
Last seen:	Never
File type:	ps1
MIME type:	application/octet-stream
ssdeep	384:UoNthBgVWXahWa7iTgAobpW2Mo0AFlvIM37SN6kGgKKrLt7Ft6AMZwsvrvu7XSiv:ClfudobntMFHrLRih1Ln1uJ
TLSH	T1FA92448167F94688F2F77F51BEBF5094483BBE6A5E32C94E0155950E08F0A18C96BF32
Magika	txt
Reporter	Mr128BitOff
Tags:	privilege-escalaction ps1 refundonex-com stealer-campaign

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ddd5ecf68adfe100399a53

Tags:

n/a

Verdict:

Unknown

File Type:

ps1

Link:

https://opentip.kaspersky.com/0100602572ed6cc62ab77ef3d413ce303f058fe8f3309718005d0c740d1735fa/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

PowerShell

Link:

https://app.malva.re/file/5ffd94ce67a6a6fe2c9c1fc9beeb8211

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aeagajls5vwmmkvxp3z5ie6oga7qld7i6myjogaalughidixgx5a._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Link

https://blog.synapticsystems.de/3000-stealer-samples-one-misconfigured-apache-server/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample