MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4b819cc534a2e954af69c5ebdf04787656b891c875a526e31bceb1013414e41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b4b819cc534a2e954af69c5ebdf04787656b891c875a526e31bceb1013414e41
SHA3-384 hash:	dfb31c4e0f4fb156d4b5f5165390b1fca80b9b00f207af5d8dc32573cbc5e8b1dcf6d3b082c50ae7562138c4b275cfe5
SHA1 hash:	3a93797098e56e249a54e2e41183187a4ee4e0d3
MD5 hash:	a4c92acb4e0e666ae59655cc2bacbef5
humanhash:	lithium-whiskey-lion-comet
File name:	92.255.57.112.ps1
Download:	download sample
Signature	SharpHide Alert Create hunting rule
File size:	124'812 bytes
First seen:	2025-01-17 19:23:23 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3072:TTieNC3EX6syh4ciFPTdTM2JiW0tDCfQHsQIOGL81wk5q+l5QhYUSX1AcbdxXSag:T3NC3EKsyh4ciFTdTM2JiW0tDCfQHsQo
TLSH	T149C32A321106BC4E9F7F1F85A84029A51CDC797BBB19C19CFBC907A9909A520DE7CEB4
Magika	powershell
Reporter	JAMESWT_WT
Tags:	92-255-57-112 booking ps1 SharpHide

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

110

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.22256.22336.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678aae58aa9c8e7858df3a91

Tags:

virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

confuserex evasive net obfuscated

Link:

https://www.filescan.io/uploads/678aae55202405e0396fe5c8/reports/dad36869-80d1-46f8-886d-db4b93f1e7d5/overview

Hybrid Analysis Trojan[Dropper]/Agent.a

Verdict:

Malicious

Labled as:

Trojan[Dropper]/Agent.a

Link:

https://www.hybrid-analysis.com/sample/b4b819cc534a2e954af69c5ebdf04787656b891c875a526e31bceb1013414e41

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded Powershell Directives

Detected one or more base64 encoded Powershell directives.

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox SharpHide

Result

Threat name:

SharpHide

Alert

Create hunting rule

Detection:

malicious

Classification:

adwa.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1593897

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected Powershell download and execute

Yara detected SharpHide

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b4b819cc534a2e954af69c5ebdf04787656b891c875a526e31bceb1013414e41

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b4b819cc534a2e954af69c5ebdf04787656b891c875a526e31bceb1013414e41/

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-17 13:04:23 UTC

File Type:

Text

AV detection:

4 of 24 (16.67%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ws4bttctjixjksxwtrpl34chq5swxci4q5nfe3rrxtvrae2bjzaq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/250117-x4cnts1mbl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.