🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98
SHA3-384 hash: 126bb1914397d741e6662c98c304286c3639ae6299b9d3d23c39233939334b67109f6fcce1406bf100a8c8f8f8ce4585
SHA1 hash: ca606997392c8dd5098048d7054e80f5b4d701ff
MD5 hash: 1455ccb9adc47bd06401f2804613c148
humanhash: lake-queen-seventeen-saturn
File name:LIVE.ps1
Download: download sample
File size:175'482 bytes
First seen:2026-05-18 23:45:08 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3072:8AYVshLoVCGlPyGiotY1kXbU9BND9Zfli8ypqMBTdNS3ywCbRoL/AfKh8PQHHfS:oe0VCvs5yBVrfcvpqATdNAywECrAfKin
Threatray 3'680 similar samples on MalwareBazaar
TLSH T14304133C27F21A4995AF419CB6FDD62038B68D3280685F08F67CC6E54B2DE725B1754C
Magika powershell
Reporter BastianHein
Tags:ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
CL CL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0ba49f9492784948344f41
Tags:
emotet shell sage smtp
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
aes base64 crypto encrypted evasive obfuscated
Link:
https://www.filescan.io/uploads/6a0ba49c861ee596e63c9e3a/reports/1d73fcbe-f1a8-409a-a93b-90ed8dc49093/overview
Verdict:
Suspicious
Labled as:
PowerShell/TrojanDropper.Agent
Link:
https://www.hybrid-analysis.com/sample/9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-03-17T05:27:00Z UTC
Last seen:
2026-05-18T20:59:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic Exploit.Win64.Shellcode.sliverloader.a
Link:
https://opentip.kaspersky.com/9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98/results?tab=lookup
Score:
88%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Base64 Block Contains Base64 Block PowerShell
Link:
https://app.malva.re/file/1455ccb9adc47bd06401f2804613c148
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98/
Verdict:
Malicious
Threat:
Exploit.Win64.Shellcode
Link:
https://tip.neiki.dev/file/9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98
Threat name:
Script-PowerShell.Trojan.Boxter
Create hunting rule
Status:
Malicious
First seen:
2026-03-17 09:16:32 UTC
File Type:
Text (PowerShell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=snb3gdhinjzouk5l5bt2zx4ej36elyx3uklntdtkxfh73z4clsma._file
Verdict:
malicious
Label(s):
novastealer
Create hunting rule
Similar samples:
0ee4884dfdabb081b394ce074fbe0dd408056ca7616694bdba188ac6db50a1e2
1d9735c8d10949ca2322708580e98dd28045e81bf2db6ac4769ffd1d16561438
2b9067eeb7909d5e78c83d9a37b379d6531a5b893d5a002b06c4f851edb1f402
5eb94225a7d4d5aff1fbea4c97e210ddbebf6f09365f658a5571f7d6b8e0da5c
7ac07536c76c62c163ceabf2e2e877fe3877b3414d95d36d50d8d5838a548fed
9353b23043743ebd6f1e9ddf137b304ebc126c811935dbad68b17359a2a726e1
9f74dcfaeb3a4e9047de4e28cc3515616e8a4c23fcb84a2dadc46f4bace80090
ae7ba52112fa966df1b3c42592f870f9106edcb3f0f3cf36f1377b6a8e41bb19
d4ddc00abfc90f17f67aa75bf122351f5c2ef7c2b9d475ac185053485c50f54d
e885dc71556edc631373746233e5b0b1d8b73f5e1ce4723d06b1eb457e7b5948
error
+ 3'670 additional samples on MalwareBazaar
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments