MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e84a382d7c154f98ccb33980ba7c5eefbb21674a2e596735b5ae87e88b7e143. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e84a382d7c154f98ccb33980ba7c5eefbb21674a2e596735b5ae87e88b7e143
SHA3-384 hash: 254537d40df27b6731924800bbc9a9b42b9da68a88fafce946074ff93111c1afca40cfe91b50a82f6fbc63dd0c7e0b47
SHA1 hash: 98bf9e5388a0e21a7d90c6477fcc5b51991e05c5
MD5 hash: 7ab8da2a30b505af56c8768cf7d145ea
humanhash: hydrogen-johnny-michigan-artist
File name:2.ps1
Download: download sample
File size:544'635 bytes
First seen:2025-01-17 08:23:51 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12288:El1fOG2gogy1+tARiuKIGK31McrhU5fYyYaM:m8G2Xx1+UKcrGgyq
TLSH T1C5C401321547BDCE8BBF1F49E98429A01C586177AB448094FDC907B952EF9208F7DEB8
Magika powershell
Reporter JAMESWT_WT
Tags:62-122-184-98 booking ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PowerShell.Obfus-9.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678a13a7aa9c8e7858df1ffb
Tags:
virus spawn
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
confuserex evasive lolbin net obfuscated regsvcs
Link:
https://www.filescan.io/uploads/678a13ad712a6bfd1529d3b7/reports/d76fc4e0-9139-43d4-8d30-43836a1e8a75/overview
Verdict:
Malicious
Labled as:
Trojan[Dropper]/Agent.a
Link:
https://www.hybrid-analysis.com/sample/7e84a382d7c154f98ccb33980ba7c5eefbb21674a2e596735b5ae87e88b7e143
Result
Verdict:
UNKNOWN
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1593510
Signature
AI detected suspicious sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1593510 Sample: 2.ps1 Startdate: 17/01/2025 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 AI detected suspicious sample 2->12 6 powershell.exe 21 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7e84a382d7c154f98ccb33980ba7c5eefbb21674a2e596735b5ae87e88b7e143
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e84a382d7c154f98ccb33980ba7c5eefbb21674a2e596735b5ae87e88b7e143/
Threat name:
Script.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-01-17 08:20:13 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 24 (25.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p2ckhawxyfkptdglgomaxj6f5353eftuulszm423lluh5cfx4fbq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/250117-kapp3sylds/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PowerShell (PS) ps1 7e84a382d7c154f98ccb33980ba7c5eefbb21674a2e596735b5ae87e88b7e143

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3400374/
  
Delivery method
Distributed via web download

Comments