MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0450eaf83f4ad5806828a12295d467ccc7b0e488248dc5d793951118f04fc523. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0450eaf83f4ad5806828a12295d467ccc7b0e488248dc5d793951118f04fc523
SHA3-384 hash:	3d6dea43cae37b55f58361209fb4088f60e2543ed91efb768d64afec0761a96ec434dcbfb0f5e8efc93d73bf10255e43
SHA1 hash:	74b3259add450e40a6d98d3ab1c943619dccaf42
MD5 hash:	2ff84378eabadcdc8373701755def7e3
humanhash:	iowa-cold-nuts-green
File name:	2..ps1
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	599'252 bytes
First seen:	2025-01-17 07:51:42 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12288:7l1fO0K+jtAyrMKKwLeyKroJFuIIqsRHx9tz3Unuoqbni:Z8AtNr+wQrWnsRRPgDqbni
TLSH	T13BD4E1721303BDCA5BBF1E49E4802A901D9D59B7AB148494BDC907E962EF910DFBCDB0
Magika	powershell
Reporter	JAMESWT_WT
Tags:	92-255-57-155 booking LummaStealer ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

110

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PowerShell.Obfus-9.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678a0c29aa9c8e7858df1ce9

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

confuserex evasive lolbin net obfuscated regsvcs stealer

Link:

https://www.filescan.io/uploads/678a0c25a364b83b70a6b9e9/reports/35481eb1-b43d-4019-9762-b4f9dcfeb1fb/overview

Hybrid Analysis Trojan[Dropper]/Agent.a

Verdict:

Malicious

Labled as:

Trojan[Dropper]/Agent.a

Link:

https://www.hybrid-analysis.com/sample/0450eaf83f4ad5806828a12295d467ccc7b0e488248dc5d793951118f04fc523

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1593460

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

AI detected suspicious sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0450eaf83f4ad5806828a12295d467ccc7b0e488248dc5d793951118f04fc523

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0450eaf83f4ad5806828a12295d467ccc7b0e488248dc5d793951118f04fc523/

ReversingLabs TitaniumCloud Script-PowerShell.Downloader.LummaStealer

Threat name:

Script-PowerShell.Downloader.LummaStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-17 07:50:43 UTC

File Type:

Text (PowerShell)

AV detection:

10 of 38 (26.32%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ariov6b7jlkya2biuerjlvdhztd3bzeiesg4lv4tsuirr4cpyurq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/250117-jqdgbayjbr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.