MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ea17807b709db137a996ba1d021f86e89a1a8257d5bb04494caa78049d4c75d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0ea17807b709db137a996ba1d021f86e89a1a8257d5bb04494caa78049d4c75d
SHA3-384 hash:	72a0dae47d544c1dd078ba3fdeeecaedf3abf9bf0ccebb2c96246438b9b147e3084c9f2d47ddc4c4292f2e677ead37db
SHA1 hash:	71b5410487f2c84a1fd842f4642d4b3afed2675f
MD5 hash:	5781d42fb63c4eaf5676b19fcdb155dd
humanhash:	oranges-foxtrot-lemon-low
File name:	ps.ps1
Download:	download sample
File size:	74 bytes
First seen:	2026-07-23 13:13:48 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJFIGFhPPFyLX3LD100qkc/0yOGUn:s8GFhP4LX7D10Ac/0zn
TLSH	T18FA022220C30020C8A02208AEE30CBF0CE2A0C008AAFECB23808B2CE0FF0F30E030000
Magika	txt
Reporter	JAMESWT_WT
Tags:	completstep-com ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

83

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/6a6213b8d215c9a9db8b205d/reports/2968eda1-8996-4533-9dad-dd979046b662/overview

Hybrid Analysis TrojanDownloader/BAT.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/BAT.Agent

Link:

https://www.hybrid-analysis.com/sample/0ea17807b709db137a996ba1d021f86e89a1a8257d5bb04494caa78049d4c75d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-07-23T11:27:00Z UTC

Last seen:

2026-07-23T19:38:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0ea17807b709db137a996ba1d021f86e89a1a8257d5bb04494caa78049d4c75d/results?tab=lookup

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/0ea17807b709db137a996ba1d021f86e89a1a8257d5bb04494caa78049d4c75d

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ea17807b709db137a996ba1d021f86e89a1a8257d5bb04494caa78049d4c75d/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b2qxqb5xbhnrg6uznoq5aipyn2e2dkbfpvn3areuzktyasouy5oq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260723-qgy5zsxwgs/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Malware Config

Dropper Extraction:

http://135.181.127.216/dl-callback/94rwryy7-6vyvayjx-hw6uuu6v-6dgkme2r/Safe-1.zip/bbf914db4b63b3d2f90da472e53f5beb

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0ea17807b709/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.