MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1846e8f852ea3dbc958fddcd1a8f8a4c2888e3e1f5603d8b95e9c18afe90477. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a1846e8f852ea3dbc958fddcd1a8f8a4c2888e3e1f5603d8b95e9c18afe90477
SHA3-384 hash:	ef5efbb6554eeed83607c346daca56fbb5b40cde06ccf48761ad8d2d4580fe043f4d22d95f544d1cb31699a885dd29f7
SHA1 hash:	660efc4ff78c4935b05879c7af349f091f329729
MD5 hash:	5573bd69ffc990125dcab7097da6f00c
humanhash:	blossom-muppet-item-green
File name:	human-verify.b-cdn.net.ps1
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	131 bytes
First seen:	2024-08-26 17:17:38 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJLNyAmarBO/tmt55akqizkVkoTMRk8nbPROkJ+NO2osk:snyuk854kqizkVkiQfOkUVxk
TLSH	T11BC09218953D294D03DAE9710C781D4B2587CB3A9BB8237AFE8520C86D61289F316748
Magika	txt
Reporter	aachum
Tags:	ps1

iamaachum

https://human-verify.b-cdn.net/verify-captcha-v1.html

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

125

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ccb8d1b2a4681a7296a9ab

Tags:

Encryption Execution Generic Infostealer Stealth

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

lolbin lolbin masquerade mshta powershell shell32

Link:

https://www.filescan.io/uploads/66ccb8cdeb26ed7f73c4cdb7/reports/04bab00f-b948-49dc-abca-3ae1619e2892/overview

Hybrid Analysis TrojanDownloader/PS.Agent

Verdict:

Suspicious

Labled as:

TrojanDownloader/PS.Agent

Link:

https://www.hybrid-analysis.com/sample/a1846e8f852ea3dbc958fddcd1a8f8a4c2888e3e1f5603d8b95e9c18afe90477

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox LummaC

Result

Threat name:

LummaC

Alert

Create hunting rule

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1499234

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus detection for URL or domain

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Powershell drops PE file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Very long command line found

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a1846e8f852ea3dbc958fddcd1a8f8a4c2888e3e1f5603d8b95e9c18afe90477

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a1846e8f852ea3dbc958fddcd1a8f8a4c2888e3e1f5603d8b95e9c18afe90477/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ugcg5d4ff2r5xsky7xondkhyutbirdr6d5lahwfzl2obrl7jar3q._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/240826-vt9vgaxblm/

Behaviour

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Downloads MZ/PE file

Malware Config

Dropper Extraction:

https://bidvertiser.b-cdn.net/bidv

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a1846e8f852ea3dbc958fddcd1a8f8a4c2888e3e1f5603d8b95e9c18afe90477