MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c
SHA3-384 hash:	e6a44386c7a854e7763301d1a741a659d3923ecc6a7e748c8592f18fc477e6bdefaff703e49f24b8381c996d4faa7571
SHA1 hash:	e36a6d5a9202361ef7baf9d1e56aee0f1b2e1de6
MD5 hash:	3073f874395c5fee164a99563055796b
humanhash:	arizona-nebraska-kentucky-whiskey
File name:	ps1.ps1
Download:	download sample
Signature	PureHVNC Alert Create hunting rule
File size:	54 bytes
First seen:	2026-04-18 10:47:32 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJFIqF1F65IFcDfZ30TM:s8qF1FuzZ1
TLSH	T1BB900214441014FDBA05C2B8A214428454336505949061E7A1148525C591A64955D81B
Magika	batch
Reporter	JAMESWT_WT
Tags:	booking insureongo-net nisuwyyyqsafdas-com ps1 PureHVNC

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

96

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69e3618145787c53e53acd7d

Tags:

trojan agent shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated powershell soft-404

Link:

https://www.filescan.io/uploads/69e3617b9124ebc08755e825/reports/f6507cea-5a36-4d12-b929-fd81c8709f13/overview

Hybrid Analysis TrojanDownloader/PS.Agent

Verdict:

Suspicious

Labled as:

TrojanDownloader/PS.Agent

Link:

https://www.hybrid-analysis.com/sample/574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-04-18T08:03:00Z UTC

Last seen:

2026-04-19T06:18:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k5fvpkbjlioylym7csh5humd6pefagzmmqod5gnfiwooisnczrga._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260418-mwb28afz3l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/574b57a8295a1d85e19f148fd3d183f3c8501b2c641c3e99a5459ce449a2cc4c