MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c2cb94a45fc267f9a9eac003836e69b6df02a3633603ae32324e0d0f4143b43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c2cb94a45fc267f9a9eac003836e69b6df02a3633603ae32324e0d0f4143b43
SHA3-384 hash: a37100da8c854ebd4d46c50e97f2365bbc11cccebb324c474dd1e04f424c4b71da5e39784f45a8ee7c960824d03bfa4f
SHA1 hash: 6ac7e517eafaba54ee59614471ffe2c86307140d
MD5 hash: 43151f625c9b414247258c42f1abf0e6
humanhash: kitten-tennessee-asparagus-pip
File name:newconvert.ps1
Download: download sample
File size:15'712 bytes
First seen:2025-04-11 04:16:27 UTC
Last seen:2025-04-29 10:35:06 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 384:NBQRp8iF2jTvEtwqen4RteRNekbUomSzsJmNMYgWo3++Ylk:N6ROiFtwZ4zq7m+HolP
TLSH T1DF62D06E523C98B6934E0C20ADEA431145EE369CAFF7C29DDA105FAC5F01984A5F4357
Magika txt
Reporter JAMESWT_WT
Tags:176-65-142-190 176-65-144-23 ps1

Intelligence

File Origin
# of uploads :
3
# of downloads :
104
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f89e15d6e7c3effacfa069
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/67f897c62d430c849e1309f4/reports/d42c927d-5aec-4888-a8bb-3b722055b91d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4c2cb94a45fc267f9a9eac003836e69b6df02a3633603ae32324e0d0f4143b43
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1662773
Signature
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1662773 Sample: newconvert.ps1 Startdate: 11/04/2025 Architecture: WINDOWS Score: 48 21 Joe Sandbox ML detected suspicious sample 2->21 7 powershell.exe 25 2->7         started        10 svchost.exe 1 1 2->10         started        process3 dnsIp4 23 Loading BitLocker PowerShell Module 7->23 13 MpCmdRun.exe 1 7->13         started        15 conhost.exe 7->15         started        19 127.0.0.1 unknown unknown 10->19 signatures5 process6 process7 17 conhost.exe 13->17         started       
Score:
3%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/4c2cb94a45fc267f9a9eac003836e69b6df02a3633603ae32324e0d0f4143b43
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c2cb94a45fc267f9a9eac003836e69b6df02a3633603ae32324e0d0f4143b43/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-10 19:13:08 UTC
File Type:
Text
AV detection:
3 of 38 (7.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jqwlsssf7qth7gu6vqadqnxgtnw7akrwgnqdvyzdetqnb5auhnbq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/250411-ewfreay1by/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4c2cb94a45fc267f9a9eac003836e69b6df02a3633603ae32324e0d0f4143b43

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PowerShell (PS) ps1 4c2cb94a45fc267f9a9eac003836e69b6df02a3633603ae32324e0d0f4143b43

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3507382/
  
Delivery method
Distributed via web download

Comments