MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee
SHA3-384 hash:	aaa5afa9c55a5212490571e29d04bc8465905d5bc7a894f5092bc331b868def2d42eaf4386ace0f92f18d009e515b8da
SHA1 hash:	9e376b21b204a30d727825ced8d2fbda2018cad6
MD5 hash:	fd26d2ef65f248319f13e157bec027ba
humanhash:	butter-yankee-colorado-king
File name:	ps.ps1
Download:	download sample
Signature	PureHVNC Alert Create hunting rule
File size:	50 bytes
First seen:	2026-04-13 18:31:38 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJFIqF1F65IFWDkVOTM:s8qF1FEq
TLSH	T195900210485014AA5B654134D210540444713505856262D63901C81604815A8C674805
Magika	batch
Reporter	JAMESWT_WT
Tags:	ghanioilandgas-com nisuwyyyqsafdas-com ps1 PureHVNC strombapylre-com

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

57

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69dd36abf68adfe100397e7a

Tags:

trojan agent shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated powershell soft-404

Link:

https://www.filescan.io/uploads/69dd36939124ebc087514c2e/reports/fde6d3a9-6d18-4318-8aad-45b98781862d/overview

Hybrid Analysis TrojanDownloader/PS.Agent

Verdict:

Suspicious

Labled as:

TrojanDownloader/PS.Agent

Link:

https://www.hybrid-analysis.com/sample/a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-04-13T15:45:00Z UTC

Last seen:

2026-04-14T02:48:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee/results?tab=lookup

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee

ReversingLabs TitaniumCloud Script-PowerShell.Downloader.Malgent

Threat name:

Script-PowerShell.Downloader.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-13 18:32:40 UTC

File Type:

Text (Batch)

AV detection:

2 of 24 (8.33%)

Threat level:

  3/5

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260413-w6eqjahv41/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a8897e97b9bf/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee