MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58
SHA3-384 hash:	6cec2c4785ad1c55fc1156c6e314a97d7a1a4efe66fda2e3df8ac01e6821c5284177536b196ee8ba833a7087d5ef981e
SHA1 hash:	83d10f96dd98a9350b399a3b7c99cc29c21c8343
MD5 hash:	48e757c227bdc2b5402038f4e6e5f036
humanhash:	freddie-robert-sixteen-east
File name:	seo.ps1
Download:	download sample
File size:	77'685 bytes
First seen:	2026-04-29 17:15:20 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	768:bQx2uDehSMCnONhlJMKe0FIiBJt7LsIXIQHxg2aU8O8Av4pruUYfkdc4GsQh:eF8hlJNzyqxg2aU8OX4prupbsQh
TLSH	T15A7302D717D90EEE9B9199D6C28AB60668BBC07B2C1D128CF5E24647B03ED20B715F34
Magika	powershell
Reporter	aachum
Tags:	can-vg dropped-by-CountLoader ps1

iamaachum

http://45.156.87.62/seo

C2:
can.vg (79.124.40.98:443)

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm base64 encrypted fingerprint obfuscated persistence powershell

Link:

https://www.filescan.io/uploads/69f23cb88a82359247ba116c/reports/e1b0fc98-62a8-430d-9068-838481757b96/overview

Verdict:

Malicious

Labled as:

PowerShell/Agent.DXQ trojan

Link:

https://www.hybrid-analysis.com/sample/12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-29T14:27:00Z UTC

Last seen:

2026-04-29T15:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1906436

Signature

Bypasses PowerShell execution policy

Contains functionality to detect sleep reduction / modifications

Early bird code injection technique detected

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential dropper URLs found in powershell memory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queues an APC in another process (thread injection)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Suspicious powershell command line found

Unusual module load detection (module proxying)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected UnHook AMSI

Behaviour

Behavior Graph:

Download SVG

Score:

78%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=clja7qael22k567o6bey5hdypr65zpxkim7ztwkdb2mvui7whnma._file

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion execution persistence

Link:

https://tria.ge/reports/260429-vswlfshx7j/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Hide Artifacts: Hidden Window

Obfuscated Files or Information: Command Obfuscation

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC Create hunting rule
Author:	ditekSHen
Description:	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Rule name:	SUSP_PowerShell_Base64_Decode Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects PowerShell code to decode Base64 data. This can yield many FP

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)