MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZigClipper

Vendor detections: 11

Intelligence 11 IOCs YARA 7 File information Comments

SHA256 hash:	bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8
SHA3-384 hash:	d616924460647e78df6bb1e10cc9cc1e3a75cdac53d0039f10fb5f5f17bc98abc1e09589990951a1255f97bcab9073f8
SHA1 hash:	f0f6ae018eb64c3171bb8a002e40859c8b837062
MD5 hash:	d9d2a405cdb5b5853e00aa33080c9ae6
humanhash:	alaska-asparagus-angel-thirteen
File name:	SecurityPatch.ps1
Download:	download sample
Signature	ZigClipper Create hunting rule
File size:	13'439 bytes
First seen:	2026-04-01 11:59:39 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	192:evq5DU0OErBNRjijnXYzrWRxTQlcdXnWqCPuHHwOMae4uYSqGgfFPjwqaalHF53j:4UaAduYKg8gwS9XqdluS5uf2
Threatray	13 similar samples on MalwareBazaar
TLSH	T19552F88763855FACB3854CEC9514712B2CF1C56F3C29209EFBE25DD7B83AE11A5A0A70
TrID	50.0% (.INI) Generic INI configuration (1000/1) 50.0% (.JSON) JSON array (generic) (1000/1)
Magika	powershell
Reporter	aachum
Tags:	celebration-internet-cc dcdivas-com dropped-by-ACRStealer ps1 SunWukong ZigClipper

iamaachum

https://dcdivas.com/wp-includes/pomo/SecurityPatch.ps1

C2: https://celebration-internet.cc/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cd08ce6363ca5d27f08b9f

Tags:

dropper cobalt small

Verdict:

Suspicious

Labled as:

TR/SNH

Link:

https://www.hybrid-analysis.com/sample/bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8

Verdict:

Malicious

File Type:

ps1

First seen:

2026-03-31T18:50:00Z UTC

Last seen:

2026-04-03T08:03:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Garvi.a PDM:Trojan.Win32.Generic PDM:Exploit.Win32.Generic

Link:

https://opentip.kaspersky.com/bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8/results?tab=lookup

Score:

90%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8/

Verdict:

Malicious

Threat:

Trojan.Win32.Garvi

Link:

https://tip.neiki.dev/file/bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8

Threat name:

Script.Trojan.Heuristic

Status:

Malicious

First seen:

2026-04-01 01:43:30 UTC

File Type:

Text (PowerShell)

AV detection:

4 of 24 (16.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x6cxrnoh3ef6czun6w6jakagc6eruwzpd6s4zfhqjccm3xz6g34a._file

Verdict:

malicious

Label(s):

unc_rust_clipper_001

ZigClipper

72c08e044dd427964bc14339f95838e3d45f51f6a586330c683fbb59ea374b1d

ZigClipper

87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886

ZigClipper

a82d031d99b15f8eb5a1d8cc24e55fec6d393d549edde8da9507f3cf17503ce1

ZigClipper

b1246e4b3421acdca8b1596c6e5455f555b5b87bcff9895f2eba5164367921e8

ZigClipper

error

ZigClipper

f23f6d7f5778168fc9e50e3da0a16ce83b97abf95d262a5d16bea7ce12b34d99

ZigClipper

f38f57709a23e71c14cc96a6b99dc3f55a7aeaf9c8c8332ad4d95c0c8d645a83

ZigClipper

fafb855519e1404ba4300e7beabe44c20172042582b1658b79e589206ff5c2e6

ZigClipper

+ 3 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260401-n6l6lsey9y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Adds Run key to start application

Executes dropped EXE

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Malware Config

Dropper Extraction:

https://dcdivas.com/wp-includes/pomo/Veritaseum.exe

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.