MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 09ee5443809176dcac8ddd954e2dca7c3ba1d0692fca9394d1f1c78e3d943f42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 09ee5443809176dcac8ddd954e2dca7c3ba1d0692fca9394d1f1c78e3d943f42 |
|---|---|
| SHA3-384 hash: | 3b4eae03bdfcf09e2bc2d09e9aa33ffef1f7bb1c068bd5c987f5877d7b910368f21d28a5c28c7e47f6e20cac02ba7e06 |
| SHA1 hash: | 7e7a6081c35b68da1b736ddd46df618514eecc5b |
| MD5 hash: | 9b3d5b2419f4d77a5828171e0b1c4707 |
| humanhash: | football-romeo-september-rugby |
| File name: | OpenLink.ps1 |
| Download: | download sample |
| File size: | 208 bytes |
| First seen: | 2026-08-16 01:12:39 UTC |
| Last seen: | Never |
| File type: |  ps1 |
| MIME type: | text/plain |
| ssdeep | 6:SuKxVABeQXiVnXKbywlf3Ggk0ZapPX2xkVA2FfAqLez6MFM:ixVABPXiIZu50Zap+qVA2Foqiz6Mm |
| TLSH | T176D02213882F04736F2000898330327BF9C2626C53878202EC90888D340033E3DF8308 |
| Magika | powershell |
| Reporter |  aachum |
| Tags: | ClickFraud ps1 unluckytool-com |
iamaachum
https://winds11.site/Setup.rarClick Fraud URL:
https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98
Intelligence
File Origin
# of uploads :
1
# of downloads :
125
Origin country :
ESVendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
90.2%
Tags:
virus shell sage
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-15T10:51:00Z UTC
Last seen:
2026-08-16T14:35:00Z UTC
Hits:
~10
Result
Threat name:
n/a
Detection:
malicious
Classification:
phis
Score:
64 / 100
Signature
AI detected malicious page (phishing or scam)
Joe Sandbox ML detected suspicious sample
Joe Sandbox ML detected suspicious webpage
Yara detected PhishFingerprint
Behaviour
Behavior Graph:
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Gathering data
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
10/10
Tags:
discovery execution
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Command and Scripting Interpreter: PowerShell
System Network Configuration Discovery: Internet Connection Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Malware Config
Dropper Extraction:
https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe ps1 09ee5443809176dcac8ddd954e2dca7c3ba1d0692fca9394d1f1c78e3d943f42
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.