MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c00a71c9ff5e42b9ed80e99a3c115350fb956ed6253c48fa2c0d749c7ed9a844. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c00a71c9ff5e42b9ed80e99a3c115350fb956ed6253c48fa2c0d749c7ed9a844
SHA3-384 hash:	da7c5afac3811e4db2f39d0b10dd7cb4ea6d47277bcf914de47b7eb5e9fb899c8a5fdfb6b0add829a65e97c2c5e539f1
SHA1 hash:	570211a6da40ea817e43993a4dc40cfc537e8a15
MD5 hash:	62523d966e22e33bc5b870e7d67c94f0
humanhash:	cola-december-louisiana-mango
File name:	92.255.57.112.ps1
Download:	download sample
File size:	123'433 bytes
First seen:	2025-01-14 07:25:23 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3072:jbUdG3oRIPejlkZ17f6f8eWDPeW03uUyicETl+uHn23LUgJiQjOC3EDbVvz2NMn2:jwG3oRTjlkZ56f8eWDPeW03uUyicUl+p
TLSH	T147C31A721207BC4E5F7F2F89A84029E11C9C7C7BAB15C59CFBC906E9619A420DE78DB4
Magika	powershell
Reporter	JAMESWT_WT
Tags:	92-255-57-112 booking ps1 Spam-ITA

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PowerShell.Obfus-9.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6786118b4487910100dec20c

Tags:

virus agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

confuserex net obfuscated

Link:

https://www.filescan.io/uploads/6786119000fbe0ad29ea7979/reports/150c8a4c-c892-437c-9c90-68007d4abcd9/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c00a71c9ff5e42b9ed80e99a3c115350fb956ed6253c48fa2c0d749c7ed9a844

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded Powershell Directives

Detected one or more base64 encoded Powershell directives.

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1590526

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Writes to foreign memory regions

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c00a71c9ff5e42b9ed80e99a3c115350fb956ed6253c48fa2c0d749c7ed9a844

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c00a71c9ff5e42b9ed80e99a3c115350fb956ed6253c48fa2c0d749c7ed9a844/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.LummaC

Threat name:

Script-PowerShell.Trojan.LummaC

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-13 07:31:52 UTC

File Type:

Text (PowerShell)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yafhdsp7lzblt3ma5gndyektkd5zk3wweu6er6rmbv2jy7wzvbca._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/250114-h9hppstjhk/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c00a71c9ff5e42b9ed80e99a3c115350fb956ed6253c48fa2c0d749c7ed9a844