MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad
SHA3-384 hash:	8664e85e798e908693dd643ec27de7b18c09239869aa16337957ae6b957cf721ae75dd210bfe52873e78fda6a558ff26
SHA1 hash:	aa9535646b0cc8ea29fd85bd78fca8721651b299
MD5 hash:	af90352dcdeb09d4a19ed975923ed038
humanhash:	aspen-sodium-item-alabama
File name:	ps_z.ps1
Download:	download sample
File size:	774 bytes
First seen:	2025-03-21 19:08:08 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12:o6wrVvKQKMf6+j+d5MOdQ6w6qRRdXh5A1ifw4A2fB7GTf:DwrVHf6+j+d552CqbdRBfwKp7Y
TLSH	T10201D50C6683C7355483B40ED585C03DD63B7A6127786A1089E59702CE53D48D7FEFA7
Magika	powershell
Reporter	JAMESWT_WT
Tags:	8-218-50-207 ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

122

Origin country :

IT

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ddb927115e7b48b48f7eeb

Tags:

virus sage blic

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67ddb92da175d31773443a9e/reports/25ae0e54-7b53-4f26-8fdd-a676e8b84335/overview

Hybrid Analysis BZC.PZQ.Boxter.826

Verdict:

Malicious

Labled as:

BZC.PZQ.Boxter.826

Link:

https://www.hybrid-analysis.com/sample/bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1645479

Signature

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: Dot net compiler compiles file from suspicious location

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Boxter

Threat name:

Script-PowerShell.Trojan.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-21 13:20:02 UTC

File Type:

Text (CSharp)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xnt7ub4jpnz2zj3tchsneo53xzew5blqgohtmmcxatsioa2p2cwq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/250321-xtargszpv8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad