MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 510898ad9082dfc559aa511848c294627df87bbbc874cb411fe9f7fc638d86d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Kimsuky


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments

SHA256 hash: 510898ad9082dfc559aa511848c294627df87bbbc874cb411fe9f7fc638d86d8
SHA3-384 hash: 5bd4943f79e7fb4ac8d30a87dd73d401c3da96e404a96711d3738038d1ffdc6cfd152f9d60e2953263b5fce9d680b8dd
SHA1 hash: 0c2a7c8be354638a9f7aa876c110c74cd0c02dda
MD5 hash: 5fe80f1b1e90815886a0553f2c322cc7
humanhash: indigo-single-kitten-fourteen
File name:demo.ps1
Download: download sample
Signature Kimsuky
File size:6'081 bytes
First seen:2023-07-25 10:30:02 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 96:KheFTjQVyiE3H1HXB5AOnNGi8UYKpDMmIVPcjpCh+3zQPpZNlBNYgoAwP3Pvhoo2:pachHNjrDM4VDQPplQCpLLr
TLSH T1A6C18410FF6ECA2A8183D15E2B56DC99F91E513221944CED7C8CD686478DE8D02FE27A
Reporter smica83
Tags:apt HUN keylogger Kimsuky ps1

Intelligence


File Origin
# of uploads :
1
# of downloads :
428
Origin country :
HU HU
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
powershell
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1279031 Sample: demo.ps1 Startdate: 25/07/2023 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 powershell.exe 11 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2023-07-24 13:04:36 UTC
File Type:
Text (PowerShell)
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Kimsuky

PowerShell (PS) ps1 510898ad9082dfc559aa511848c294627df87bbbc874cb411fe9f7fc638d86d8

(this sample)

  
Delivery method
Distributed via web download

Comments