MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vjw0rm

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8
SHA3-384 hash:	53015a226521938af2e1dace4c1bdd416e03482f52c5c881cd7fddc05ab4a66a9fcb1dbd90b6a3670e70a056790b0209
SHA1 hash:	eb0260097544a08a56bb5206eabd58802c9bb135
MD5 hash:	0f3a46479b2b0c3614147d008df71ee4
humanhash:	papa-xray-papa-coffee
File name:	dy515430.ps1
Download:	download sample
Signature	Vjw0rm Create hunting rule
File size:	57'193 bytes
First seen:	2026-04-30 20:59:36 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	768:bfNEstR6k4yJwipQDKmLa1ebAZnVsGfYWqHqj+Ep3okuOfIt6jHdW82Zo5hQ4/zc:2stYLMZn2pH6ftq6I/cC4outGT
TLSH	T1BD43CFF7AC7156D96ADF133508EAE1F42719336D1E9336396B0095A9AA3120243CB377
Magika	powershell
Reporter	BastianHein
Tags:	ps1 vjw0rm

Intelligence

File Origin

# of uploads :

# of downloads :

152

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm base64 encrypted fingerprint obfuscated obfuscated powershell

Link:

https://www.filescan.io/uploads/69f3c2f7792fe2d217a9efd9/reports/41ef6d86-5aa5-4da3-8c49-d34d356aae6d/overview

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-27T16:54:00Z UTC

Last seen:

2026-05-02T01:13:00Z UTC

Hits:

~10

Detections:

Trojan.PowerShell.Cobalt.sb

Link:

https://opentip.kaspersky.com/9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8/results?tab=lookup

Score:

85%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8/

Verdict:

Malicious

Threat:

Trojan.PowerShell.Cobalt

Link:

https://tip.neiki.dev/file/9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8

Threat name:

Script-PowerShell.Downloader.Malgent

Status:

Malicious

First seen:

2026-04-30 20:55:26 UTC

File Type:

Text (PowerShell)

AV detection:

6 of 24 (25.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=trn3huu6tmzducjli5tummxbnt7s5oqrqwvs5umrhq7bfq36uo4a._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution

Link:

https://tria.ge/reports/260430-ztlvvshz9x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Looks up external IP address via web service

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	SUSP_PowerShell_Base64_Decode Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects PowerShell code to decode Base64 data. This can yield many FP

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)