MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 836ffd22263c910babc25497ac16ac849ec3ee9836691e9f8cf68ae4aa1fbf4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	836ffd22263c910babc25497ac16ac849ec3ee9836691e9f8cf68ae4aa1fbf4e
SHA3-384 hash:	040caa4e56d660af6b4a582596bb562d8558a40862fb39b63aeda684ab83b0b11c470e054ec2592e5ddb38df39136169
SHA1 hash:	6b26a9551e70ff02464ef821626157e2523a7d09
MD5 hash:	bdf2ab5fbe5eb3ac97ab01d85667a6ba
humanhash:	princess-east-william-friend
File name:	provenotrobot.b-cdn.net.ps1
Download:	download sample
File size:	139 bytes
First seen:	2024-09-03 15:41:36 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJLNyAmarBO/tmt55akAuTktwkGCSkDkGC9o0yj3IufFIkVkmF:snyuk854kUnAdGttzZftF
TLSH	T122C02B35DCCE70480EA99890240F0DCF51078115D7773319F44404480C2412BCF09B0C
Magika	txt
Reporter	aachum
Tags:	ps1

iamaachum

https://provenotrobot.b-cdn.net/captcha-verification-v2.html

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

126

Origin country :

ES

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.HEUR.Trojan.PowerShell.Generic.6999.24942.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66d72e4e8e12b8124ac91bed

Tags:

Encryption Execution Generic Infostealer Stealth

Hybrid Analysis TrojanDownloader/PS.Agent

Verdict:

Suspicious

Labled as:

TrojanDownloader/PS.Agent

Link:

https://www.hybrid-analysis.com/sample/836ffd22263c910babc25497ac16ac849ec3ee9836691e9f8cf68ae4aa1fbf4e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1503605

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Encrypted powershell cmdline option found

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Very long command line found

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/836ffd22263c910babc25497ac16ac849ec3ee9836691e9f8cf68ae4aa1fbf4e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/836ffd22263c910babc25497ac16ac849ec3ee9836691e9f8cf68ae4aa1fbf4e/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qnx72irghsiqxk6cksl2yfvmqspmh3uygzur5h4m62fojkq7x5ha._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/240903-s5bqps1grh/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Malware Config

Dropper Extraction:

https://getyourpages.com/downloads/t2

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/836ffd22263c910babc25497ac16ac849ec3ee9836691e9f8cf68ae4aa1fbf4e