MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7
SHA3-384 hash: 0eb851ee4f15b3db0013e6901e608ed14128c887652bd601397ed81a3916949b43690d9eac672a0c79a4914bfd7cc71f
SHA1 hash: e06729d861044574cfd60640258821162fc193bb
MD5 hash: 7e2eb98757430ce004efe6ffd856e030
humanhash: yankee-mars-mike-berlin
File name:index.ps1
Download: download sample
File size:126'620 bytes
First seen:2026-03-31 05:39:28 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 1536:upAZ1OUf7wZkL976N8odeOMATYJMkBFHntcZNE84rvRtI3yJ0zLv8dEgSMXHyVLw:rGRm
TLSH T173C358E713980AAE6B9089D7C149760758EBC17B2C5E1389F9E25607F13F920B726F70
Magika powershell
Reporter abuse_ch
Tags:ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
SE SE
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Script.SNH-gen.45363212.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69cb5e473a18a6e1ddeff38e
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 conhost encrypted fingerprint obfuscated persistence powershell powershell
Link:
https://www.filescan.io/uploads/69cb5e442346b9da57b25a58/reports/4f831521-89d8-4da8-9ced-ac324992ed6a/overview
Verdict:
Malicious
Labled as:
PowerShell/Agent.DXQ trojan
Link:
https://www.hybrid-analysis.com/sample/12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-03-30T21:34:00Z UTC
Last seen:
2026-03-31T04:45:00Z UTC
Hits:
~10
Detections:
Trojan-Dropper.PowerShell.Agent.afj Trojan-Dropper.PowerShell.Agent.afi
Link:
https://opentip.kaspersky.com/12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1891258
Signature
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Early bird code injection technique detected
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Potentially Suspicious PowerShell Child Processes
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1891258 Sample: index.ps1 Startdate: 31/03/2026 Architecture: WINDOWS Score: 100 60 k8s-ingressn-bscmainn-3f9a19480b-888004326.us-east-1.elb.amazonaws.com 2->60 62 mpla-clo.cc 2->62 64 bsc-dataseed.bnbchain.org 2->64 72 Suricata IDS alerts for network traffic 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 Antivirus detection for dropped file 2->76 78 6 other signatures 2->78 9 powershell.exe 1 32 2->9         started        12 powershell.exe 59 2->12         started        14 powershell.exe 14 17 2->14         started        16 powershell.exe 2->16         started        signatures3 process4 signatures5 88 Creates autostart registry keys with suspicious values (likely registry only malware) 9->88 90 Creates an autostart registry key pointing to binary in C:\Windows 9->90 92 Uses schtasks.exe or at.exe to add and modify task schedules 9->92 18 powershell.exe 15 34 9->18         started        22 conhost.exe 9->22         started        24 schtasks.exe 1 9->24         started        26 schtasks.exe 1 9->26         started        94 Early bird code injection technique detected 12->94 96 Writes to foreign memory regions 12->96 98 Loading BitLocker PowerShell Module 12->98 28 PresentationSettings.exe 12->28         started        30 csc.exe 12->30         started        33 powershell.exe 12->33         started        35 conhost.exe 12->35         started        100 Found suspicious powershell code related to unpacking or dynamic code loading 14->100 37 conhost.exe 16->37         started        process6 dnsIp7 66 79.124.59.142, 49693, 49699, 49700 TAMATIYA-ASBG Bulgaria 18->66 80 Early bird code injection technique detected 18->80 82 Queues an APC in another process (thread injection) 18->82 39 csc.exe 18->39         started        42 powershell.exe 18->42         started        44 prevhost.exe 18->44         started        68 k8s-ingressn-bscmainn-3f9a19480b-888004326.us-east-1.elb.amazonaws.com 98.95.128.167, 443, 49718 TWC-11351-NORTHEASTUS United States 28->68 70 mpla-clo.cc 172.67.149.95, 443, 49719 CLOUDFLARENETUS United States 28->70 84 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 28->84 86 Unusual module load detection (module proxying) 28->86 58 Temp_f47f46e520cf4...a10372bbe08526f.dll, PE32 30->58 dropped 46 cvtres.exe 30->46         started        48 conhost.exe 33->48         started        file8 signatures9 process10 file11 56 Temp_bc362093fed44...2ed81765b1f0eff.dll, PE32 39->56 dropped 50 cvtres.exe 39->50         started        52 conhost.exe 42->52         started        54 WerFault.exe 44->54         started        process12
Score:
50%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7/
Verdict:
Malicious
Threat:
Trojan-Dropper.PowerShell.Agent
Link:
https://tip.neiki.dev/file/12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7
Threat name:
Win32.Adware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-03-31 00:59:40 UTC
File Type:
Text (PowerShell)
AV detection:
4 of 36 (11.11%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cktrqjco2lxapvn7aign46x5xhr3hpbk2suey7eaehf4jx25t6tq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion execution persistence
Link:
https://tria.ge/reports/260331-gc2kwah14v/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Adds Run key to start application
Hide Artifacts: Hidden Window
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC
Create hunting rule
Author:ditekSHen
Description:Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PowerShell (PS) ps1 12a718244ed2ee07d5bf020cde7afdb9e3b3bc2ad4a84c7c8021cbc4df5d9fa7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3806858/
  
Delivery method
Distributed via web download

Comments