🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c
SHA3-384 hash: f7f9330329c646482c8eb912876539271c19ebe7911a30ded404b1be86bf6aa3ecc3e00551a987f0c22409283736ca3f
SHA1 hash: c4dd6c1419959247b9f32338c2059ddcade65aa9
MD5 hash: cfe1ddc4403014679c17072ba0883e8e
humanhash: magazine-hydrogen-glucose-thirteen
File name:tianyangge.com.ps1
Download: download sample
File size:18'156 bytes
First seen:2026-05-08 07:31:36 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 384:YRuTCZu7yrY7fluAEyHpZZa1v9nnWy41MoLgnjW5z5z5CLFpF87i/+:dpaRnxoLgnjY15QP8V
TLSH T11182F9053BF514A742821AA4E1CEC30D9B29416B61591E90BEDCC3C4FF6213EA7F5BE9
Magika powershell
Reporter JAMESWT_WT
Tags:booking nisuwyyyqsafdas-com ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm fingerprint masquerade
Link:
https://www.filescan.io/uploads/69fd9163df14f1cb2acd8599/reports/c30e17cb-0364-4eb5-9e71-84e951e211d1/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c
Verdict:
Malicious
File Type:
ps1
First seen:
2026-05-08T05:35:00Z UTC
Last seen:
2026-05-08T05:56:00Z UTC
Hits:
~10
Detections:
Trojan.PowerShell.Agent.sb HEUR:Trojan.Win64.Generic HEUR:Trojan.Win64.Aotnet.gen
Link:
https://opentip.kaspersky.com/34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c/results?tab=lookup
Score:
91%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
PowerShell
Link:
https://app.malva.re/file/cfe1ddc4403014679c17072ba0883e8e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-08 07:31:19 UTC
File Type:
Text (PowerShell)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gtc3ohtvkiwcybweknbnx7ics5xeratorwfpsydt25weexu3bwoa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/260508-jcsn3ses6t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Malware Config
Dropper Extraction:
https://tianyangge.com/h0v6wg63gK4DY2Sbkpy7eOnbTqgRSpzYDTgpjubd3qg7
https://halfmillion-iq.com/clubcampestrededurango.zip
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_ClickFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:ClickFix social engineering and malicious PowerShell commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments