MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8
SHA3-384 hash:	6197309b040bb6fa150cd3aa5ceaaa05851e412ae61fbacedf462f01664e92c81869ba583a7880da5bf9b2512f1b9371
SHA1 hash:	7d27beb658b2b3f347bb55df274ecefd5e485dfd
MD5 hash:	f8e5a1b2cdb2d5a2036a602249ad0934
humanhash:	stream-monkey-pip-jersey
File name:	ps.ps1
Download:	download sample
Signature	PureHVNC Alert Create hunting rule
File size:	46 bytes
First seen:	2026-04-03 08:42:06 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJFIqF1F65IFbXLdx:s8qF1FZZx
TLSH	TNULL
Magika	batch
Reporter	JAMESWT_WT
Tags:	nisuwyyyqsafdas-com ps1 PureHVNC

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

100

Origin country :

IT

Vendor Threat Intelligence

ACCE

Gathering data

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cf7d753a18a6e1ddf0dec9

Tags:

obfuscate shell agent

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated powershell powershell soft-404

Link:

https://www.filescan.io/uploads/69cf7d6a00ad3636940ad457/reports/8b683c33-2e60-41ec-b36c-3a2291cf38bb/overview

Hybrid Analysis PowerShell/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

PowerShell/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-04-03T07:20:00Z UTC

Last seen:

2026-04-05T02:06:00Z UTC

Hits:

~100

Detections:

Trojan.PowerShell.Cobalt.sb Trojan-Spy.Agent.HTTP.C&C PDM:Trojan.Win32.Generic Backdoor.Agent.HTTP.C&C Trojan.PowerShell.Agent.sb NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C

Link:

https://opentip.kaspersky.com/63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8/results?tab=lookup

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8/

Neiki Trojan.PowerShell.Cobalt

Verdict:

Malicious

Threat:

Trojan.PowerShell.Cobalt

Link:

https://tip.neiki.dev/file/63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260403-kl5knsfz2v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8