MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 629c324c37ac630713373e8f4573c5e0992e0a38f9b1e0b2fc6e6f7135ece39c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | 629c324c37ac630713373e8f4573c5e0992e0a38f9b1e0b2fc6e6f7135ece39c |
|---|---|
| SHA3-384 hash: | 7a057f2a51b537e6aa8ecd04ba5988b65e9d77f5b858ccf41d000b45c79040a09a69a861443bb220282906c352966adc |
| SHA1 hash: | ec8ad626195e1ea40e23974ba45be0cabb537387 |
| MD5 hash: | 07965f3dd8fdbe52dd27ba62678cb710 |
| humanhash: | magazine-massachusetts-november-colorado |
| File name: | urlid.ps1 |
| Download: | download sample |
| File size: | 22'746 bytes |
| First seen: | 2025-09-10 09:42:52 UTC |
| Last seen: | 2025-09-10 17:33:50 UTC |
| File type: |  ps1 |
| MIME type: | text/plain |
| ssdeep | 384:tozZVQZSsaJxcZc22H9ccaSkkYyH2+as2k0gko0F8gYlhdfPghXPNwQvnxhZK:tKQAtxcD2dcNSkFyHzjH0gkVF8guhdfv |
| Threatray | 340 similar samples on MalwareBazaar |
| TLSH | T12DA2D00FE0CBCFA30E3044F48972BB65E18A9D40A6BBCDC9F9893157F15E294747A189 |
| Magika | autoit |
| Reporter |  pr0xylife |
| Tags: | ps1 |
Intelligence
File Origin
# of uploads :
2
# of downloads :
50
Origin country :
DEVendor Threat Intelligence
Verdict:
Malicious
Score:
92.5%
Tags:
trojan agent shell
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated
Verdict:
Malicious
File Type:
ps1
First seen:
2025-09-10T00:10:00Z UTC
Last seen:
2025-09-10T00:10:00Z UTC
Hits:
~10
Detections:
Trojan-Downloader.Agent.HTTP.C&C Trojan.Win64.SBEscape.adq PDM:Trojan.Win32.Generic NetTool.PowerShellGet.HTTP.C&C NetTool.PowerShellUA.HTTP.C&C
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Gathering data
Verdict:
Malicious
Threat:
NetTool.Win64.HTTP
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2025-09-10 03:47:34 UTC
File Type:
Text
AV detection:
6 of 37 (16.22%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
rhadamanthys
Similar samples:
+ 330 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Executes dropped EXE
Badlisted process makes network request
Downloads MZ/PE file
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
ps1 629c324c37ac630713373e8f4573c5e0992e0a38f9b1e0b2fc6e6f7135ece39c
(this sample)
exe
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.