🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9
SHA3-384 hash: 8971e48372d87bb5e3cced4c914362082119c6ff3238eafed681d71168f6fde95a78f78d751c9aedbe4175454aaf2b34
SHA1 hash: 13ec621da3eb8b71e022cae04eac91eb27358007
MD5 hash: 968375807112c97780732bbaf55d6b3e
humanhash: lima-carpet-triple-lake
File name:xgkbp_01.ps1
Download: download sample
File size:1'676 bytes
First seen:2026-04-26 23:17:09 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 48:pAlbYyQgQaAAzrxJRaRVSkdj4Oggz4J5MyzQw:pQbYyQgQadzrxSDvj4mzjykw
TLSH T14A317A505BF69608B2B25E05A9BE64925D3B7BBE6D35CA0C0050C54E1BB2A44CC7BF32
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika autohotkey
Reporter BastianHein
Tags:ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
CL CL
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Script.SNH-gen.82115212.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ee9d534aed15d07930dd50
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/69ee9d1dc06ec088bf5f5975/reports/cca27c6e-1ecb-448b-9a04-7288d1970328/overview
Verdict:
Suspicious
Labled as:
DR/SNH
Link:
https://www.hybrid-analysis.com/sample/6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9
Verdict:
Clean
File Type:
text
Link:
https://opentip.kaspersky.com/6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9/results?tab=lookup
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-26 22:45:33 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n4qty2hseumkzsznt5abwhykcuy77xypgryul77hxorbfykl5lmq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260426-295c9ahz8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments