MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 801fb26e8cb14860719bcc96fce99e7e10bca39aeebbc9c5e3cc74af7d00a23b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 6 File information Comments

SHA256 hash:	801fb26e8cb14860719bcc96fce99e7e10bca39aeebbc9c5e3cc74af7d00a23b
SHA3-384 hash:	0ebe9d4d599b4e870cfa7dfeb03df3f497ab48e81a214c03e3eb9033a52478aea012201aaf6cb51a6ffd134dcae93e45
SHA1 hash:	07cf4a5ba7bb30fb01a124d213f0b7e875d0c4ef
MD5 hash:	843fb94bb64d69e1892c50c1c2008d74
humanhash:	green-finch-social-bacon
File name:	87648736456384.ps1
Download:	download sample
File size:	4'551 bytes
First seen:	2026-09-23 00:56:59 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	96:yYkRxw4NQPI2eHg4A39/3lFZL1RwVwIwx0Aov09oKS0+3ooX0IoIg3LlG:vkRxog2eHgTxZLrizQo+oKO3oodoIH
TLSH	T162912158721151649A72AF39CD876D4AFF3F50AF10B31300769D51502FF2A2FCB98ACA
Magika	powershell
Reporter	skocherhan
Tags:	ps1 pub-43fc211373d547278dd3d5bd0b4d9dac-r2-dev

skocherhan

http://pub-43fc211373d547278dd3d5bd0b4d9dac.r2.dev/87648736456384.ps1

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Trojan.PS.Agent.9631.26979.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypto downloader dropper evasive explorer lolbin packed

Link:

https://www.filescan.io/uploads/6ab323eb0f98dead3ba85a5d/reports/aad4e37b-317b-4ae8-8c75-80f9c10ba6ae/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/801fb26e8cb14860719bcc96fce99e7e10bca39aeebbc9c5e3cc74af7d00a23b

Verdict:

Unknown

File Type:

ps1

First seen:

2026-09-09T22:55:00Z UTC

Last seen:

2026-09-15T03:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/801fb26e8cb14860719bcc96fce99e7e10bca39aeebbc9c5e3cc74af7d00a23b/results?tab=lookup

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/801fb26e8cb14860719bcc96fce99e7e10bca39aeebbc9c5e3cc74af7d00a23b

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/801fb26e8cb14860719bcc96fce99e7e10bca39aeebbc9c5e3cc74af7d00a23b/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2026-09-10 11:33:11 UTC

AV detection:

5 of 24 (20.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qap3e3umwfega4m3zslpz2m6pyilzi425254trpdzr2k67iaui5q._file

Result

Malware family:

n/a

Score:

10/10

Tags:

defense_evasion execution persistence spyware trojan

Link:

https://tria.ge/reports/260923-ba2vzabc97/

Behaviour

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: PowerShell

Drops file in Windows directory

Drops file in System32 directory

Executes dropped EXE

Badlisted process makes network request

Downloads MZ/PE file

Modifies Windows Defender notification settings

Malware Config

Dropper Extraction:

https://pub-43fc211373d547278dd3d5bd0b4d9dac.r2.dev/PlutonAgent.exe

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/801fb26e8cb14860719bcc96fce99e7e10bca39aeebbc9c5e3cc74af7d00a23b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Detect_Zoom_Invite_malware_RAT_C2 Create hunting rule
Author:	daniyyell
Description:	Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	SUSP_Scheduled_Tasks_Create_From_Susp_Dir Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)