MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7160b07ddebad54e15efc03d6e1cdc004613aea7e799da748e8542a74bd830ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kimsuky


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7160b07ddebad54e15efc03d6e1cdc004613aea7e799da748e8542a74bd830ce
SHA3-384 hash: a07eb1a51785fcd555099235c5c2c8075ae6af7d5bd7b840c47cbffc562eb8ee60802ba2c95f5a05754f1e8112c34d2c
SHA1 hash: fc840ba6890b63ff57d788e4ed42ca82a8b4eb7a
MD5 hash: 8c44750ad8bbca79db2973c24e87bb92
humanhash: cat-oven-mirror-march
File name:payload_1.ps1
Download: download sample
Signature Kimsuky
Create hunting rule
File size:40'059 bytes
First seen:2024-08-02 08:38:54 UTC
Last seen:2024-08-02 08:40:07 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 768:v0P1DkD7tP/Lw5vM+6v56VegEii0l0GbzCvwpuF5Vb3EKnY2FPPOvhUE/9/iSpix:8tIELtLRYHY3plDo
TLSH T10203F75DDF673D4C9799A0F702CE50E50EBD03EB18A10AEE462EC3986F7841194E92CE
Reporter wwwab
Tags:apt Kimsuky ps1

Intelligence

File Origin
# of uploads :
3
# of downloads :
163
Origin country :
US US
Vendor Threat Intelligence
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ac9b29037b02d0daed1185
Tags:
Generic Pwshell
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/66ac9b2e9149fd55f993a16d/reports/ccd62337-bd90-41b6-abe5-164bf24260d0/overview
Verdict:
Malicious
Labled as:
GT_VB_PwShell_20_2634F658
Link:
https://www.hybrid-analysis.com/sample/7160b07ddebad54e15efc03d6e1cdc004613aea7e799da748e8542a74bd830ce
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1486562
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1486562 Sample: payload_1.ps1 Startdate: 02/08/2024 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 powershell.exe 11 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7160b07ddebad54e15efc03d6e1cdc004613aea7e799da748e8542a74bd830ce
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7160b07ddebad54e15efc03d6e1cdc004613aea7e799da748e8542a74bd830ce/
Threat name:
Script-PowerShell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2024-07-31 09:52:40 UTC
File Type:
Text (VBS)
AV detection:
6 of 38 (15.79%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ofqla7o6xlku4fppya6w4hg4abdbhlvh46m5u5eoqvbkos6ygdha._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/240802-kkanxatcql/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments