MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Konni

Vendor detections: 7

Intelligence 7 IOCs YARA 11 File information Comments

SHA256 hash:	805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094
SHA3-384 hash:	3c2fc9ddde34badc502609e9f29f35b52ec06ed4060a4670ad2670800d92e18d137d43d56fb10bf96cd1e53e9643455d
SHA1 hash:	e95f481e851d886e47504e08482131daa9778fb4
MD5 hash:	9eb39bfa5c5ba5493aa9ee3cfd63048d
humanhash:	nevada-glucose-california-summer
File name:	SANC_Nine_KBW_Seoul_backdoor_decrypted.ps1
Download:	download sample
Signature	Konni Create hunting rule
File size:	44'185 bytes
First seen:	2026-10-11 22:51:01 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	768:k0YqFMxn+XGoK86S03o34qziVVk3MX/k6HBHWD78n:5YqFMgXpK/S03o34qziVV5/k6H+78n
TLSH	T16F1318363E46D0AA07C3EF85EAC2D908DE69413C1B7A4510B6FCC084374AB69DBED957
Magika	powershell
Reporter	Daydream
Tags:	apt backdoor decrypted KONNI ps1

Daydream

Decrypted final stage of be5ba9de52af8ecd2fd7f6a97eeb8f05e8587bdcb01722bf26487dcc87489ac1 (never on disk in this form; decrypted in memory from DiagnosisUTC_Storage_Error.err, 6f574714403c37dd55531a25105c964a6522af7e58f2154f22905667d81eae10). 1,348-line PowerShell backdoor. C2 https://fe29jf323.kesug.com/YE97Bw999zB87t1U8i.php: POST JSON with header MODE = LI (login: devid, username, privlvl, wanip, lanip, curpath, buildinfo, initinfo), GC (get tasks), RP (report), UF/DF (chunked file transfer); task types cmd, powershell, download, upload. Solves the host's aes.js anti-bot page with cscript.exe, cookie __test. buildInfo SANC_Nine_KBW_Seoul, mutex Global\SysInfoProject_019d3efa-657d-73c5-b3d3-70a9a2ea5c39, poll 30 s. Config is the Load-Config token (same key-XOR-salt scheme).

Intelligence

File Origin

# of uploads :

# of downloads :

118

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Script.SNH-gen.46144441.UNOFFICIAL

Gathering data

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm anti-vm base64 crypto encrypted evasive fingerprint obfuscated reconnaissance

Link:

https://www.filescan.io/uploads/6acc12e33b90a56ed62ef05d/reports/4dd01fe0-203f-4ee7-8d81-263e115a1f54/overview

Verdict:

Malicious

Labled as:

CMD:BZC.PZQ.Boxter.1027

Link:

https://www.hybrid-analysis.com/sample/805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094

Verdict:

Malicious

File Type:

ps1

First seen:

2026-10-11T20:51:00Z UTC

Last seen:

2026-10-13T03:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094/results?tab=lookup

Score:

67%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Base64 Block Contains Base64 Block Html PowerShell T1059.001 T1105

Link:

https://app.malva.re/file/9eb39bfa5c5ba5493aa9ee3cfd63048d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094/

Threat name:

Script.Trojan.Boxter

Status:

Malicious

First seen:

2026-10-11 22:51:31 UTC

File Type:

Text (PowerShell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qbpg43axbzvdlydc5kc5djpwhm5qei2z2j72kvjxuvhlg5w3qcka._file

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/261011-2sx8lsfz5l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Power Settings

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC Create hunting rule
Author:	ditekSHen
Description:	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Rule name:	OBFUS_PowerShell_Common_Replace Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the common usage of replace for obfuscation

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SCRIPT_Dropper_Unknown_ForgeAuto_628f41a1 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (script_js, etat binaire)

Rule name:	SUSP_PowerShell_Base64_Decode Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects PowerShell code to decode Base64 data. This can yield many FP

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)