MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37add2beff07df8c4ddede7a113df8e88d66f8ebf58ec8ffac558ee5470da019. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	37add2beff07df8c4ddede7a113df8e88d66f8ebf58ec8ffac558ee5470da019
SHA3-384 hash:	d3d918f2f06f7de9a1487c4e10cf2e778faaec757f92985ee40bd642e33f4925a73730f864191f87cf47cf3aa1599461
SHA1 hash:	51e45ceda42f0e718eb056765d44af20673442c9
MD5 hash:	4aeaf6756199980ef77ad514e95e7b97
humanhash:	high-asparagus-purple-idaho
File name:	inadvisable34.ps1
Download:	download sample
Signature	KoiLoader Alert Create hunting rule
File size:	180 bytes
First seen:	2024-06-04 06:58:41 UTC
Last seen:	2024-06-11 14:36:23 UTC
File type:	ps1
MIME type:	text/plain
ssdeep	3:L+3A/HJ+a31VKFF5fkDwRrsI5VeYBMRjCsQHJ7fwYEK7RCGsTLjFSYBAUn:BH82jKFF5cDtI5VeYSeBJ7fjrCrLjFrL
TLSH	T189C0123C190195A3596770D7B1A6705CFDCEB994224044397AA3B15E919811F1E59250
Reporter	JAMESWT_WT
Tags:	45-154-204-97 dsestimation-com KoiLoader ps1 shalom-pt

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

131

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.SuspectCRC.31739.29723.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=665ed7d2ab69e84d6a2f5712win7simulatehigh_evasion

Tags:

Other Stealth Suspectcrc

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/665ebb3b0bf5978c0b0bfced/reports/477edcff-281b-4a8c-98ab-a69e1badcc1e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/37add2beff07df8c4ddede7a113df8e88d66f8ebf58ec8ffac558ee5470da019

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

3 / 100

Link:

https://www.joesandbox.com/analysis/1451573

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/37add2beff07df8c4ddede7a113df8e88d66f8ebf58ec8ffac558ee5470da019

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/37add2beff07df8c4ddede7a113df8e88d66f8ebf58ec8ffac558ee5470da019/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g6w5fpx7a7pyyto63z5bcppy5cgwn6hl6whmr75mkwhokrynuamq._file

Threatray unknown

Verdict:

unknown

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/240604-hr3l6ahc76/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/37add2beff07df8c4ddede7a113df8e88d66f8ebf58ec8ffac558ee5470da019