MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ce42177bafe552495b8329726bb4acfcb5f9e886377a2e76fb901fa01ae407c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9ce42177bafe552495b8329726bb4acfcb5f9e886377a2e76fb901fa01ae407c
SHA3-384 hash:	2fbae085c3b77a2de5d22e11a3722ab5970461ac3f02c24c0aaf568bd7c77adafc09070324c07bc9130c6334a10b1111
SHA1 hash:	a03742d37684df4ec933277e8200e2fb8eb634db
MD5 hash:	cb0fe0fe3a20381a4a894216eef11d0e
humanhash:	bulldog-mockingbird-stairway-sad
File name:	e.ps1
Download:	download sample
Signature	Konni Alert Create hunting rule
File size:	3'815 bytes
First seen:	2025-03-24 08:28:20 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	48:tBhMFfZtHUuiDnPHybtrYN+8K9Kzba7DuUaIMakwTDREZWWvlFbyRc+/+8h8QHFn:tB0fZt0BPSiN6+1UaI98WWvlFS/XH2g
TLSH	T11771EA484DE3A7EA9B499D22D7655D8870213F5B8C0F42DBE51C881FCB5073732245DE
Magika	powershell
Reporter	smica83
Tags:	apt KONNI ouck6s5mxghmwz57tzkzj ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

121

Origin country :

HU

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e2470aacb044ea849e9821

Tags:

stration spawn shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

evasive lolbin persistence powershell schtasks wscript

Link:

https://www.filescan.io/uploads/67e11813de7b23ce171cf7b6/reports/feccc7ad-030d-4143-a305-c6e87c537818/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/9ce42177bafe552495b8329726bb4acfcb5f9e886377a2e76fb901fa01ae407c

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1646812

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9ce42177bafe552495b8329726bb4acfcb5f9e886377a2e76fb901fa01ae407c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9ce42177bafe552495b8329726bb4acfcb5f9e886377a2e76fb901fa01ae407c/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ttscc5527zksjfnygklsno2kz7fv7huimn32fz3pxea7uanoib6a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/250324-kdk63avsas/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Adds Run key to start application

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.