MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239
SHA3-384 hash:	9216718d105f0bad97eaca6b335efe6f70e10aeaf0114af701851f93c9cb4b5971596b91ff7fa4d012b8d1022aca0536
SHA1 hash:	a1ba988d14e915606870cdcdf642e156f6355f44
MD5 hash:	1d6577a80f1ec6ee40df87f8cb83c96d
humanhash:	montana-ink-ink-green
File name:	a.ps1
Download:	download sample
File size:	167 bytes
First seen:	2026-05-01 04:34:47 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJFILqt4ySF+XXxjBhPeM+nGfALtGTPh9JewMhHLNKwoxGKyOGYmKLAMH:s8Fy2GxjbP/+GMGzJ0RLNKwOrzyK0G
TLSH	T108C0C0600001452C43126045CA708FC4437930A4B5128111FE705ECC82D03701600258
Magika	shell
Reporter	BastianHein
Tags:	ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

128

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.IA.Suspicious.32146623.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm base64 dropper evasive fingerprint persistence powershell powershell

Link:

https://www.filescan.io/uploads/69f42d9d2fcb905ec2776f93/reports/d10cb097-d91d-41f8-bea6-caaa050965d3/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-04-30T18:58:00Z UTC

Last seen:

2026-05-02T01:26:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan.PowerShell.AmsiBypass.n HEUR:Trojan.Script.Miner.gen Trojan.PowerShell.AmsiBypass.sb Trojan.PowerShell.Agent.sb HackTool.PowerShell.AmsiBypass.sb Trojan.Win32.Reconyc.sb Trojan.PowerShell.DefenderDisabler.sb PDM:Trojan.Win32.Generic Trojan.MSIL.Agent.sb Trojan-PSW.Disco.HTTP.C&C Trojan-Dropper.Win32.Agent.sb Trojan-Downloader.PowerShell.Agent.sb NetTool.PowerShellPost.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C NetTool.PowerShellUA.HTTP.C&C not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen not-a-virus:RiskTool.Win32.BitCoinMiner.ouoj not-a-virus:HEUR:RiskTool.Script.BitMiner.gen RiskTool.Miner.UDP.C&C not-a-virus:RiskTool.Win64.XMRigMiner.a

Link:

https://opentip.kaspersky.com/4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239/results?tab=lookup

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239/

Neiki RiskTool.Script.BitMiner

Verdict:

Malicious

Threat:

RiskTool.Script.BitMiner

Link:

https://tip.neiki.dev/file/4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j3xd27qy3zdpdooc5wvlesxukw4hpdn52ynberfygaqec6gmgi4q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260501-e72g9ags3r/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Executes dropped EXE

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239