MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1380de313395f6c8be7b99d54261ee64c2ee377457d2e717684be710498a951d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 3 File information Comments

SHA256 hash:	1380de313395f6c8be7b99d54261ee64c2ee377457d2e717684be710498a951d
SHA3-384 hash:	338048d0c05d568f38ff22d27805fbf3ab3add51757de6277aa792553edba0695ef5d66f735d19a1791359bb72db8ee1
SHA1 hash:	323a9af42f246681e0268ec127e5cc58bc78b176
MD5 hash:	44184431067de5bd81f1d89890a93d1a
humanhash:	two-cardinal-bravo-november
File name:	run.ps1
Download:	download sample
File size:	33'188 bytes
First seen:	2026-11-03 11:23:14 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	384:dY4n24p9VegPHbrHrT4D3HvpNSdiTe/sJ1QDzSuQWqW44hQpsKRMRrHHD51U7K24:Og24X3CUsJV5G86I7K2L6qs
TLSH	T143E20041A7FA0148F1F76B44EA3F48650B37BD259932CA0D529C198E0BF3A1498A7F77
Magika	powershell
Reporter	xor
Tags:	ps1

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae9c4561a457820544ac982

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

evasive fingerprint obfuscated

Link:

https://www.filescan.io/uploads/6ae9c458a378dea68604a88c/reports/33b40056-3554-4f19-8761-59be3d082a88/overview

Verdict:

Malicious

Labled as:

CMD:BZC.PZQ.Boxter.1223

Link:

https://www.hybrid-analysis.com/sample/1380de313395f6c8be7b99d54261ee64c2ee377457d2e717684be710498a951d

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-01T13:58:00Z UTC

Last seen:

2026-11-05T00:54:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1380de313395f6c8be7b99d54261ee64c2ee377457d2e717684be710498a951d/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

phis.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1997330

Signature

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables the Smart Screen filter

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

31%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/1380de313395f6c8be7b99d54261ee64c2ee377457d2e717684be710498a951d

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

PowerShell T1059.001 T1105

Link:

https://app.malva.re/file/44184431067de5bd81f1d89890a93d1a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1380de313395f6c8be7b99d54261ee64c2ee377457d2e717684be710498a951d/

Threat name:

Script.Trojan.Boxter

Status:

Malicious

First seen:

2026-08-30 19:24:01 UTC

File Type:

Text (PowerShell)

AV detection:

4 of 24 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=coan4mjtsx3mrpt3thkueypomtbo4n3uk7joof3ijptrasmksuoq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

execution

Link:

https://tria.ge/reports/261103-nhrfesgz6y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Malware Family:

boxter

Malicious:

True

Tags:

exe-pattern detect-debug-environment powershell obfuscated

Link:

https://intel.virussign.com/intelligence/file/1380de313395f6c8be7b99d54261ee64c2ee377457d2e717684be710498a951d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/1380de313395f6c8be7b99d54261ee64c2ee377457d2e717684be710498a951d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)