MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e
SHA3-384 hash:	462395144a51da6585a129e7f3cee41ee7cc8da0e9247fb5c420a6c7c80e49a406fac48aa5bc70f6e3361a0a63c3b01e
SHA1 hash:	9a502855a8fa98803c6ce86956428fcd1033ed5b
MD5 hash:	13fe7b3e9e2c726406e691b1f30310a9
humanhash:	alaska-hotel-bulldog-hydrogen
File name:	jskeowgo.com.ps1
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	117 bytes
First seen:	2026-04-03 18:07:55 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:LjD0rSLqVMnlRl7bJJFISkMoVsBeLYXLzEfFOLCP1wUpVW1dqCn:L0GLqVMlRv8SkMTUoqFOL6GU7W6C
TLSH	T1B3B0125B7852869C5F0DC621631D3F212B13438593A8EAC7E9D996A02C5D42D4213C9C
Magika	batch
Reporter	JAMESWT_WT
Tags:	asfasfqwf-com booking NetSupport ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

96

Origin country :

IT

Vendor Threat Intelligence

ACCE

Gathering data

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.IA.Suspicious.28362183.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d0021a6a61012f6ace6eaa

Tags:

vmdetect autorun madi

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

text

Link:

https://opentip.kaspersky.com/1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e/results?tab=lookup

Nucleon Malprob Benign

Score:

15%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dak3z6ugzegqutlldpow2bhohd5slhi7gstj4s2tvf3rey6h2wha._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport discovery execution rat

Link:

https://tria.ge/reports/260403-wqze1afy4q/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Drops startup file

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

NetSupport

Netsupport family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e