MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28bbe522cc081b787548ed524fdceccd6a84dcf70aa449ec6b8e710bc48ba973. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	28bbe522cc081b787548ed524fdceccd6a84dcf70aa449ec6b8e710bc48ba973
SHA3-384 hash:	d434f3286bed7a235b9e35c41a3fe952d884dcc7d7f89b53645293656dd5b4c15f38a8759babf0a1b3acab1d34ebdb9c
SHA1 hash:	32bb3fb3b91df10c89bdc56e2a00be95fe0c4851
MD5 hash:	9eff1c84b5fea6976f49eb3bf6ff519e
humanhash:	whiskey-december-solar-artist
File name:	28bbe522cc081b78.ps1
Download:	download sample
File size:	4'732 bytes
First seen:	2026-11-09 08:00:52 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	96:37dD3RUl+ivWdCpkyM03BEPocMKp64Ul3KExoi0pRMHa:3VBY+EWd/y1BEBp6EExoi0pRM6
TLSH	T1A5A1DE54AE00DCD08C1F29E3CDAABEA9D12D0376CEC7B785019CE5D91BB6B618A5DC84
Magika	powershell
Reporter	Tuxxin
Tags:	ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

22

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress

Gathering data

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/28bbe522cc081b787548ed524fdceccd6a84dcf70aa449ec6b8e710bc48ba973

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/28bbe522cc081b787548ed524fdceccd6a84dcf70aa449ec6b8e710bc48ba973/

ReversingLabs TitaniumCloud Text.Downloader.Generic

Threat name:

Text.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-11-09 08:01:35 UTC

File Type:

Text (PowerShell)

AV detection:

1 of 36 (2.78%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fc56kiwmbanxq5ki5vje7xhmzvvijxhxbkset3dlrzyqxrelvfzq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution spyware

Link:

https://tria.ge/reports/261109-jxemysav9k/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

cURL User-Agent

Browser Information Discovery

Command and Scripting Interpreter: PowerShell

System Time Discovery

Drops file in Program Files directory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Badlisted process makes network request

Downloads MZ/PE file

VirusSign gen446

Malware Family:

gen446

Alert

Create hunting rule

Malicious:

True

Tags:

self-delete wmi-activity debugger-check exec-delay adapter-discovery powershell macro-powershell obfuscated

Link:

https://intel.virussign.com/intelligence/file/28bbe522cc081b787548ed524fdceccd6a84dcf70aa449ec6b8e710bc48ba973

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/28bbe522cc081b787548ed524fdceccd6a84dcf70aa449ec6b8e710bc48ba973