MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d80e5c7d07aef7d4565f4ddc61d3fc5819a5ea68f2d5282e6ae3e5e17d60e3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8d80e5c7d07aef7d4565f4ddc61d3fc5819a5ea68f2d5282e6ae3e5e17d60e3d
SHA3-384 hash:	f760dea62b1fa6b7522263a2f70a1bde5e6b8a12678f6bdb6d2251993c20c359e4b376414c62faedfd5a633e1d95e934
SHA1 hash:	4790b36cdbbededed079473ff1c5c34637f2a2f6
MD5 hash:	4c99ba8c0fcf994162c991b2b6601509
humanhash:	blossom-cola-monkey-ten
File name:	verification.b-cdn.net.ps1
Download:	download sample
Signature	Stealc Alert Create hunting rule
File size:	139 bytes
First seen:	2024-08-10 17:08:55 UTC
Last seen:	2024-08-19 16:05:54 UTC
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJLNyAmarBO/tmt55akqizkVkoTMRk8nbPROkJ+Eg9qYn:snyuk854kqizkVkiQfOkUE2
TLSH	T174C02B085038684D03DAE53008385D4F2103CB39D7381339EC4100C80D10184F31130C
Reporter	aachum
Tags:	ps1 Stealc

iamaachum

https://verification.b-cdn.net/verify-captcha-v1.html

Asked to paste PowerShell script and run it through Win+R.

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

140

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66b79eafaa5b40be0a9ff60b

Tags:

Encryption Execution Generic Infostealer Network Stealth Trojan

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

lolbin lolbin masquerade mshta powershell shell32

Link:

https://www.filescan.io/uploads/66b79eb28c27a84b6bb5ea0e/reports/755735fb-7b53-4884-a00b-c59cffd62f8d/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8d80e5c7d07aef7d4565f4ddc61d3fc5819a5ea68f2d5282e6ae3e5e17d60e3d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox Go Injector, Stealc

Result

Threat name:

Go Injector, Stealc

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1491044

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Found malware configuration

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Powershell drops PE file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Very long command line found

Writes to foreign memory regions

Yara detected Go Injector

Yara detected Powershell download and execute

Yara detected Stealc

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/8d80e5c7d07aef7d4565f4ddc61d3fc5819a5ea68f2d5282e6ae3e5e17d60e3d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d80e5c7d07aef7d4565f4ddc61d3fc5819a5ea68f2d5282e6ae3e5e17d60e3d/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rwaolr6qplxx2rlf6to4mhj7ywazuxvgr4wvfaxgvy7f4f6wby6q._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/240810-vn4fhatapa/

Behaviour

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Downloads MZ/PE file

Malware Config

Dropper Extraction:

https://bidvertiser.b-cdn.net/smart1

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8d80e5c7d07aef7d4565f4ddc61d3fc5819a5ea68f2d5282e6ae3e5e17d60e3d