MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e28f186f3855291ec84b24da61938ab604d90d3121e1667f50bda632a5a3dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4e28f186f3855291ec84b24da61938ab604d90d3121e1667f50bda632a5a3dd8
SHA3-384 hash:	30de998db98b6b542fbfeaef8de4dbcea13cd673a1888207ce6e170e6893838f8a9a3da04eeab429aeb9f5c058371810
SHA1 hash:	64ddeb31a5e4d08e221b14599717d52c3eeabd16
MD5 hash:	ee764444b11e57a5d41a0ba938902caa
humanhash:	one-robin-beer-spring
File name:	kim22.ps1
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	177'364 bytes
First seen:	2025-04-03 07:14:22 UTC
Last seen:	2025-04-11 04:16:16 UTC
File type:	ps1
MIME type:	text/plain
ssdeep	3072:OmK1+YjwSw+rt765j5kFigzkFqtJASXy/xWQGPVuLTWXG6JUW6YmG7yDQPRw9:OmKcMwSjt76bYgqM/x4XGAiyK
TLSH	T19D04010089482F948EEC9A0940F6171E53F04A5E454E799AFF73AE427FFB646131B1DE
Magika	powershell
Reporter	abuse_ch
Tags:	176-65-142-190 PhantomStealer ps1

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

100

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.14437.1260.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ee37f7cfd0a37f830cfe37

Tags:

virus shell hype

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

confuserex dropper obfuscated packed packed

Link:

https://www.filescan.io/uploads/67ee358f2d430c849e043a01/reports/16f0504f-99da-4bf1-adfe-b838ea13a841/overview

Hybrid Analysis PowerShell_TrojanDropper_Agent_AQD

Verdict:

Malicious

Labled as:

PowerShell_TrojanDropper_Agent_AQD

Link:

https://www.hybrid-analysis.com/sample/4e28f186f3855291ec84b24da61938ab604d90d3121e1667f50bda632a5a3dd8

Joe Sandbox Phantom stealer, Stealerium

Result

Threat name:

Phantom stealer, Stealerium

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1655355

Signature

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

PE file has nameless sections

Powershell drops PE file

Yara detected Costura Assembly Loader

Yara detected Phantom stealer

Yara detected Powershell decode and execute

Yara detected Stealerium

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4e28f186f3855291ec84b24da61938ab604d90d3121e1667f50bda632a5a3dd8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e28f186f3855291ec84b24da61938ab604d90d3121e1667f50bda632a5a3dd8/

ReversingLabs TitaniumCloud Script-PowerShell.Dropper.Remcos

Threat name:

Script-PowerShell.Dropper.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-02 06:14:55 UTC

File Type:

Text (PowerShell)

AV detection:

9 of 24 (37.50%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jyupdbxtqvjjd3eewjg2mgjyvnqe3egtcipbmz7vbpnggks2hxma._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250403-h3f8as11c1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4e28f186f3855291ec84b24da61938ab604d90d3121e1667f50bda632a5a3dd8