MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a3c353b1bd9bff9c0f8a109fd21fe331eb9cb0e86f5c260df52f9eba2f13f72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9a3c353b1bd9bff9c0f8a109fd21fe331eb9cb0e86f5c260df52f9eba2f13f72
SHA3-384 hash:	5d8d6f73c7436fecc745619bc79994c2c246d8ebc05df2d62df8e0c68a265d429c6c1481b8e8a8023533977b1bd9f412
SHA1 hash:	268e59f7f0b336bf80c4518de0136e5c32317fab
MD5 hash:	1bd38fdc88fb4420eb2875c9cd2f85c4
humanhash:	connecticut-maine-princess-maine
File name:	9a3c353b1bd9bff9c0f8a109fd21fe331eb9cb0e86f5c260df52f9eba2f13f72.ps1
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	341'201 bytes
First seen:	2025-01-17 08:15:50 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	6144:72s1zAOok9Y3sOGnuerPkwo67g3Lk7pyFV50GuGdtqphBddqyIFr2JdyPrnxiNHp:7l1fOgcJrk6TKx
TLSH	T1C1742C318805B91F8EEF1F8BB5402FD37C79217BDF551018A88F16B86A68238597AF74
Magika	powershell
Reporter	JAMESWT_WT
Tags:	92-255-57-155 booking ps1 xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

102

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PowerShell.Obfus-9.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678a11c64487910100dfbd3d

Tags:

virus msil

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

confuserex evasive net obfuscated

Link:

https://www.filescan.io/uploads/678a11c8f75fad451ac4779b/reports/beb12ec0-541d-47de-8b92-9ba6562b9742/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/9a3c353b1bd9bff9c0f8a109fd21fe331eb9cb0e86f5c260df52f9eba2f13f72

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1593503

Signature

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Writes to foreign memory regions

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9a3c353b1bd9bff9c0f8a109fd21fe331eb9cb0e86f5c260df52f9eba2f13f72

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a3c353b1bd9bff9c0f8a109fd21fe331eb9cb0e86f5c260df52f9eba2f13f72/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.LummaC

Threat name:

Script-PowerShell.Trojan.LummaC

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-13 23:06:51 UTC

File Type:

Text

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ti6dkoy33g77tqhyuee72ip6gmpltsyoq324eyg7kl46xixrh5za._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250117-j548ksyjez/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.