MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8eface3e2723166235148398f5eaedfd27bb962b3adfb814d48ee84d1353857e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8eface3e2723166235148398f5eaedfd27bb962b3adfb814d48ee84d1353857e
SHA3-384 hash: 07532c59c6b38a03736188430d809a7bc0030be75f1e1fb43fc46c3bb927d933f7f14e6b47c08c928a5eb7d95db24c1f
SHA1 hash: 4d911ca35311c3edb85262c1c66d1155242b7461
MD5 hash: 80b920d13cd0d47437d3c8cc993d400d
humanhash: white-double-item-fillet
File name:fdgdjhddhggffh
Download: download sample
File size:141'996 bytes
First seen:2022-11-28 14:33:38 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3072:pd58InX4eNRAq+mJODW47QtXdgL2juCi6+hALvcv:pd58InRAqezMd02j+Ocv
TLSH T17CD35BF956411C0FCD1806F1F825070A3D79DECBAEE8D066AA87B918D54E06492F7EBC
Reporter JAMESWT_WT
Tags:ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.44506.19684.18648.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/6384c6db536377388865ec5a/reports/431f700b-960b-48fe-a4c3-03e428753578/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1123080
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 755804 Sample: fdgdjhddhggffh.ps1 Startdate: 29/11/2022 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 powershell.exe 26 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8eface3e2723166235148398f5eaedfd27bb962b3adfb814d48ee84d1353857e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-11-28 14:37:10 UTC
File Type:
Text
AV detection:
7 of 26 (26.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r35m4prhemlgeniuqompl2xn7ut3xfrlhlp3qfgur3ue2e2tqv7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8eface3e2723166235148398f5eaedfd27bb962b3adfb814d48ee84d1353857e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:SUSP_Reversed_Base64_Encoded_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an base64 encoded executable with reversed characters
Reference:Internal Research
Rule name:SUSP_Reversed_Base64_Encoded_EXE_RID3291
Create hunting rule
Author:Florian Roth
Description:Detects an base64 encoded executable with reversed characters
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PowerShell (PS) ps1 8eface3e2723166235148398f5eaedfd27bb962b3adfb814d48ee84d1353857e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2435858/
  
Delivery method
Distributed via web download

Comments