MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 7 File information Comments

SHA256 hash:	b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041
SHA3-384 hash:	539c854df2f0280e5d64dc47b5a016b4f02b19fc2f9e58da6fcbba125080874b288019bcbd3bb80521353997ff921f8d
SHA1 hash:	18347b54073f7d63bd85553d29e3751918c61ea3
MD5 hash:	388636d04a2e5f85c93f67db34fd7722
humanhash:	paris-network-venus-single
File name:	fakemas.ps1
Download:	download sample
File size:	3'308 bytes
First seen:	2026-09-13 23:34:01 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	96:U3im6NnztX94QjCZ548e36xih4AE+b1Hf:U3ibNztN4Q+Z548eqxihIuHf
TLSH	T1C461A85AB7D0E2B18AB31919CCC5A795643B407221135610B2BD87547F9CD9FC7A33CA
Magika	powershell
Reporter	ave9858
Tags:	fakemas ps1

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm conhost crypto evasive lolbin obfuscated persistence schtasks

Link:

https://www.filescan.io/uploads/6aa732f59fd8a3780e0edecb/reports/a60b1ec2-046a-4872-bda9-fe909919d51b/overview

Verdict:

Suspicious

Labled as:

TrojanDownloader/PS.NetLoader

Link:

https://www.hybrid-analysis.com/sample/b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041

Verdict:

Adware

File Type:

ps1

First seen:

2026-09-13T21:54:00Z UTC

Last seen:

2026-09-14T20:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041/results?tab=lookup

Score:

34%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041

Verdict:

Malware

YARA:

2 match(es)

Tags:

DeObfuscated PowerShell T1027 T1059.001 T1105

Link:

https://app.malva.re/file/388636d04a2e5f85c93f67db34fd7722

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041/

Threat name:

Script-Python.Hacktool.KMSActivator

Status:

Malicious

First seen:

2026-09-13 23:34:23 UTC

File Type:

Text (PowerShell)

AV detection:

6 of 24 (25.00%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wk63fjhjh635jyww7b74e7uac33ewmnfhu3tx42mdtxoyauhkbaq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/260913-3khnmashla/

Behaviour

Modifies registry key

Runs ping.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: PowerShell

Executes a command shell one-liner

System Network Configuration Discovery: Internet Connection Discovery

Drops file in Windows directory

Launches sc.exe

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Malware Config

Dropper Extraction:

https://get.activatedd.win/Update.zip

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Detect_Remcos_RAT Create hunting rule
Author:	daniyyell
Description:	Detects Remcos RAT payloads and commands

Rule name:	Detect_Zoom_Invite_malware_RAT_C2 Create hunting rule
Author:	daniyyell
Description:	Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2

Rule name:	SUSP_Scheduled_Tasks_Create_From_Susp_Dir Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	WIN_ClickFix_Detection Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:	ClickFix social engineering and malicious PowerShell commands