🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 670b2bf5b58ea667fbc3febe5e9fa3783175c7258a92e86e30c1512fcbd1c7f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 670b2bf5b58ea667fbc3febe5e9fa3783175c7258a92e86e30c1512fcbd1c7f0
SHA3-384 hash: b4bddfeb8ae6849d89683aff64605fccb54f3ada7908e61f9dff0be586b196789a425d0c8c73355f5b46ddeff42d527f
SHA1 hash: ea5f92a018b7e7934a930338c5231cc9fb99c950
MD5 hash: 76c60745ee41d6be46028dc533f244d1
humanhash: fix-illinois-east-ohio
File name:P516.ps1.ps1
Download: download sample
File size:8'116 bytes
First seen:2026-10-30 21:54:32 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 96:/f0YEZh3GKxGMrpPVqPv7WJl64+oAgmyrUrSVLHDhMnCTAjtuTM/9XhWAR02eAZ9:/foOKxGBvCxrUrSVLHDhKcAjAM/LgPi9
TLSH T146F132419324DECC4FB5129878D6B5A570501F1942EE3A5C87B2AEF4940BBC8F37E24D
Magika powershell
Reporter rifteyy
Tags:Loader ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
CZ CZ
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Script.SNH-gen.89773188.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae51248b121dd519dceef34
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 evasive obfuscated
Link:
https://www.filescan.io/uploads/6ae51248ad82d36c33ab8163/reports/fd3961ed-c392-4454-b431-5867838a6766/overview
Verdict:
Suspicious
Labled as:
PowerShell/Kryptik.PC trojan
Link:
https://www.hybrid-analysis.com/sample/670b2bf5b58ea667fbc3febe5e9fa3783175c7258a92e86e30c1512fcbd1c7f0
Verdict:
Clean
File Type:
ps1
First seen:
2026-10-30T19:05:00Z UTC
Last seen:
2026-10-30T20:50:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/670b2bf5b58ea667fbc3febe5e9fa3783175c7258a92e86e30c1512fcbd1c7f0/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1995598
Signature
AI detected malicious Powershell script
Antivirus detection for URL or domain
Can disable PowerShell antimalware scanning and event logging
Contains functionality to inject code into remote processes
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Powershell connects to network
Suricata IDS alerts for network traffic
Unusual module load detection (module proxying)
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/670b2bf5b58ea667fbc3febe5e9fa3783175c7258a92e86e30c1512fcbd1c7f0
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated PowerShell T1027 T1059.001
Link:
https://app.malva.re/file/76c60745ee41d6be46028dc533f244d1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/670b2bf5b58ea667fbc3febe5e9fa3783175c7258a92e86e30c1512fcbd1c7f0/
Threat name:
Script-PowerShell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-10-30 21:55:22 UTC
File Type:
Text (PowerShell)
AV detection:
8 of 23 (34.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m4fsx5nvr2tgp66d727f5h5dpayxlrzfrkjoq3rqyfis7s6ry7ya._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/261030-1sxfmsft7v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Looks up external IP address via web service
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/670b2bf5b58ea667fbc3febe5e9fa3783175c7258a92e86e30c1512fcbd1c7f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://tria.ge/261030-1pp76assbw

Comments


Avatar
Daydream commented on 2026-11-01 20:18:21 UTC

Family attribution & 5-stage unpacking correlation for C2 https://redjaxfire.com/nfront.php (ThreatFox IOC 2006129) and https://redjaxfire.com/nback.php (ThreatFox IOC 2006465):
- The implant communicating with redjaxfire.com (109.238.86.137:443) and secondary payload host apapg.com (172.67.148.208:443) is LegionLoader / Satacom / CurlyGate (Malpedia: win.satacom, MalwareBazaar sig: LegionLoader).
- Unpacked 5-stage delivery chain from http://78.159.131.254/281 (URLhaus 4049347) and http://78.159.131.254/yrjrs/ver.pa (URLhaus 4049380):
1. Stage 1 PowerShell (281.ps1, sha256 7eb0d8e8f74b298885fa0ec0a0ee1e87b03e27fbff5fe41ae99edacfaac2d1a3): patches AMSI/ETW/ScriptBlockLogging, AES-256-CBC decrypts ver.pa (25941c08...) with key 5b83f0dd6cbe63a84aafc777eab97e8feee7440cd556712602a0f32b206f1897
2. Stage 2 PIC XTEA-ECB loader (0936cb3e..., key 8ba790cf98a88b29d007437bc9789315)
3. Stage 3 MinGW-w64 37-phase crypter PE64 (0c692fdd..., AES-256-CBC key c1adbdeb94a72e6ab4b93ee0cddd6cb204c0e0f854bd5fc27bba49a58ddf0a20, IV 22b18ee4c1192514d2d87bfa719816f7 + byte reversal)
4. Stage 4 PIC reflective loader (9724ef49..., AES-256-CBC key 7511ba5949c310025fea54df5052ae7adf5aa66870b31bb10e045b28681271df, IV 21183e38a8466e502d7c19c6c2de48a8 + byte reversal)
5. Stage 5 LegionLoader / Satacom PE64 (00ef251f6f49eb50f3300585c814910318e7f09864ed373ec4f078d2c1471d0e): C2 redjaxfire.com (/nfront.php, /nback.php), User-Agent Vivaldi/5.3.2679.68, wire RC4 key 10dda87d124c6c60368b7b814dad0279c3c7f03e86d58df8d9458523b24ea1, campaign ID 0xb3c845a7, Chromium NativeMessagingHosts persistence, and Chrome IElevator App-Bound Encryption bypass shellcode (0740a99c...).