MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8
SHA3-384 hash: 849bb27987f81539c64129f912500b5659803471706e13ac8e14d959551a21829101c4389dde05ffbf42185f53fc811f
SHA1 hash: df930932d050da0f11b1245873b0beb01f3f6e10
MD5 hash: e2fc22b92cace6eb0a4a1ff5a1ea9cc2
humanhash: virginia-ten-moon-fish
File name:johnn.ps1
Download: download sample
File size:418'477 bytes
First seen:2026-02-05 08:40:59 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12288:sz5ffxfItTZMU+vonBHNGQy64szN0UthdUW:sNSj+vonpgQEs9RUW
Threatray 88 similar samples on MalwareBazaar
TLSH T150941222EC6DDC9108ACA12528542C8A6A120F3B4C58BB393F9E6B4D1F4E25FD4757FD
Magika powershell
Reporter JAMESWT_WT
Tags:45-153-34-90 makeway3-hopto-org ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
44
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698457ae3361f35a4b0b2c02
Tags:
obfuscate xtreme shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 crypt powershell
Link:
https://www.filescan.io/uploads/698457ac930564ff3c8c4273/reports/6abc2fff-1352-43d9-aa0b-9789ec06c006/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8
Verdict:
Malicious
File Type:
ps1
First seen:
2026-02-03T03:42:00Z UTC
Last seen:
2026-02-05T05:47:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.InjectorNetT.s Trojan.PowerShell.Agent.azq PDM:Trojan.Win32.Generic Backdoor.Agent.TCP.C&C
Link:
https://opentip.kaspersky.com/59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8
Threat name:
Script-PowerShell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-02-03 08:41:03 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 36 (16.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lhicflp5m6npmz56djyegvn2yxwg6reztcjvle2uhbmq5z3rapua._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
0a08eb9584f6fa1594367d7fd8aa29fd173227458be4718d31ded9066af0c216
0c0a32f550ab253b514075b72bcdf112667a818fb89729d6cc0814b8e370bb38
476b1e41f8ee1f1acd39aa3d20a1f1139d323b0fde1dcae997fc69fee4a40217
9dd8fc258b7ba53803c0dad3f5c4608e059360d36ca459fa74241426db7d7d44
c0b1fa407b6f1c7a2c0636febc35adf5494f887dd5001be9bd5fab0870ad2ecd
c6ae803a939ceb15eb048bbc3460c176bc41a7f4a6c951429a0263ee78254763
d5dfede85187855607aee7925e3d51571456e3955e7d4ead33ccbe6d391285a0
error
f35e1bf6989c5f59c2b621c35bc62978a652977a0474b52c9969ceb2fad3540c
+ 78 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260205-kljyzab17a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments