MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20d4139b2aa2ec4cd8664706ed43d7276b837a96f8831fbfc226e286a915ccce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	20d4139b2aa2ec4cd8664706ed43d7276b837a96f8831fbfc226e286a915ccce
SHA3-384 hash:	ff9d627806d9b9ef4048d512a249e0f2f1720c2c7aa5e0782e728ed8d9380c299227374f94b7b2736ab1ae21bf1aeb3b
SHA1 hash:	f657bb24ae7f8b3ae02fd99b670ade2b8a525f46
MD5 hash:	a8d0e04e31ff72e7b717720d8721249f
humanhash:	glucose-october-three-emma
File name:	ftbB6m9N.ps1
Download:	download sample
File size:	485 bytes
First seen:	2025-08-13 16:43:05 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	6:yNsnASW5YD/H8YjPr6QrsrCBCi6tHJEOL2impJpGaAQhEwnf4UX4f4BmFJFOgGF9:2gU62Dilk2dpHzlWa4UXA4IZCF2XhK
TLSH	T1C6F02EB16EC7C44744A7456EB83316DA8E199B1882853D32ECE47C6EA497500252A3A4
Magika	powershell
Reporter	aachum
Tags:	AMSIBypass call-kakao-com ps1

iamaachum

https://pastebin.com/raw/ftbB6m9N

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

48

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689cbb3c2018ee52f02474fa

Tags:

virus shell spawn

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/689cc0b0397fd3ce6fa7daa6/reports/d98096ac-612c-4d0a-afca-14bbfe1e0198/overview

Hybrid Analysis PowerShell/Agent.CLS trojan

Verdict:

Malicious

Labled as:

PowerShell/Agent.CLS trojan

Link:

https://www.hybrid-analysis.com/sample/20d4139b2aa2ec4cd8664706ed43d7276b837a96f8831fbfc226e286a915ccce

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1756215

Signature

AI detected malicious Powershell script

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

4%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/20d4139b2aa2ec4cd8664706ed43d7276b837a96f8831fbfc226e286a915ccce

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/20d4139b2aa2ec4cd8664706ed43d7276b837a96f8831fbfc226e286a915ccce/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/20d4139b2aa2ec4cd8664706ed43d7276b837a96f8831fbfc226e286a915ccce

ReversingLabs TitaniumCloud Script-PowerShell.Hacktool.AMSIBypass

Threat name:

Script-PowerShell.Hacktool.AMSIBypass

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-26 17:08:46 UTC

File Type:

Text (PowerShell)

AV detection:

10 of 38 (26.32%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=edkbhgzkulwezwdgi4do2q6xe5vyg6uw7cbr7p6ce3rinkivztha._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/250813-t8dj5s1jz4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.15

Link:

https://yomi.yoroi.company/submissions/20d4139b2aa2ec4cd8664706ed43d7276b837a96f8831fbfc226e286a915ccce