MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5
SHA3-384 hash:	0c50e99c30210d623c642e09a00dc6c24067e69b860f4ef0c7e82ebd9c22633162e961df766c0baa18b531950d3544f6
SHA1 hash:	6ce79450481c1af490414aed81541690d61aac0b
MD5 hash:	8b02ae9b385fd3372ad6509ccc605553
humanhash:	river-cat-happy-pennsylvania
File name:	ps.ps1
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	100 bytes
First seen:	2026-04-08 08:42:36 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJFISnMcXR/JJNLNNQXLzEfOWM3FAJJArTyyN1shwdn:s8SMOBd+qAAJeTVm8n
TLSH	T1E4B01233C0E446FEAF5FC83590151C58390002D8C3148FD136D052497C0CCC8C32280C
Magika	txt
Reporter	JAMESWT_WT
Tags:	booking hsgeowvi-com lkhpihf-com NetSupport ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

91

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d615236a61012f6ad00747

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/69d61533fd15f1ca1cced954/reports/1e2e9df0-265a-4b96-8040-f2a9685de78b/overview

Hybrid Analysis TrojanDownloader/PS.NetLoader

Verdict:

Suspicious

Labled as:

TrojanDownloader/PS.NetLoader

Link:

https://www.hybrid-analysis.com/sample/1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5

Kaspersky OpenTIP Adware

Verdict:

Adware

File Type:

ps1

Detections:

NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C

Link:

https://opentip.kaspersky.com/1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5/results?tab=lookup

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dmzfcmfohedwdidm6qqon6p43dd745v2uczvn2jo6bnsenju3xkq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260408-kmsx9sdy5k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5