MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48364b9ddc93be1ec7e93ff73adc2dc435783a572e6a924a4861930757106228. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	48364b9ddc93be1ec7e93ff73adc2dc435783a572e6a924a4861930757106228
SHA3-384 hash:	2139dba6c39d96f3289d2159c01bc2f68f90e1d6d0fbbdbf7258375a5ef30efd6b074bca42dcedb4867ee873656e4546
SHA1 hash:	7bd568cc4374fbf7f9a71e0a2b9bf31dc5d985d0
MD5 hash:	3a064ad7a9e93144e26935fc9b018a8e
humanhash:	five-utah-romeo-pizza
File name:	3.ps1
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	538'496 bytes
First seen:	2025-01-17 08:23:47 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	6144:eVe/8jH/fkbaAiHnVExoyZYwOiY1LBSUkf2jFgdIVgMbJN+5PVu1Zhn6w/lAVigl:eFwoW2h7dVI42CoeUJ2z6m20uFqwgU
TLSH	T1F2B47D3240537C5F3B9A2ECEA4006EC00C5839A77618D154AE899276F2FD53B9E6D9FC
Magika	powershell
Reporter	JAMESWT_WT
Tags:	62-122-184-98 booking LummaStealer ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

118

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PowerShell.Obfus-9.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678a13a54487910100dfbe74

Tags:

virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

confuserex evasive lolbin net obfuscated regsvcs

Link:

https://www.filescan.io/uploads/678a13ac202405e0396fcc16/reports/3ff1b773-0557-4970-9313-6200aca8c38c/overview

Hybrid Analysis Trojan[Dropper]/Agent.a

Verdict:

Malicious

Labled as:

Trojan[Dropper]/Agent.a

Link:

https://www.hybrid-analysis.com/sample/48364b9ddc93be1ec7e93ff73adc2dc435783a572e6a924a4861930757106228

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox LummaC

Result

Threat name:

LummaC

Alert

Create hunting rule

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1593511

Signature

AI detected suspicious sample

LummaC encrypted strings found

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/48364b9ddc93be1ec7e93ff73adc2dc435783a572e6a924a4861930757106228

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/48364b9ddc93be1ec7e93ff73adc2dc435783a572e6a924a4861930757106228/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.LummaSteal

Threat name:

Script-PowerShell.Trojan.LummaSteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-17 08:20:13 UTC

File Type:

Text

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ja3exho4so7b5r7jh73tvxbnyq2xqosxfzvjessimgjqovyqmiua._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/250117-kapp3sylc1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.