🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206
SHA3-384 hash: e06c8335db634b90ff8a76f99524f27b7fd05fd13eb42af5895380daae27a2fb730338afeadd5f51975e6c95df67aa7d
SHA1 hash: b4f7396e7519d4c881537b73cfd5564a6808f8af
MD5 hash: 623b6d9b9d4022ed5613ac13444adb7a
humanhash: fillet-georgia-video-hotel
File name:HO4DFFamfjZp.ps1
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:14'856 bytes
First seen:2026-04-26 15:03:23 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 192:MZ585kERu2Q7vz4z9yefMz7mbIszIcDdakesZIFjDOXjafY5OXh5bB3sh4:YfjO09z7mD3dZnbGfY5s5bBD
TLSH T16162B66A7C47E466C1F39B7ADAEBB154FA2B147B13521040B9ECC1D06FB0C74D2A4E98
Magika powershell
Reporter BastianHein
Tags:ps1 vjw0rm

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
CL CL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ee293f4aed15d07930b397
Tags:
autorun shell virus sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 encrypted evasive fingerprint lolbin obfuscated persistence powershell powershell powershell schtasks vbc
Link:
https://www.filescan.io/uploads/69ee29404cc9288c910ad770/reports/88844a85-1024-476a-8e23-7edd6074adef/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206
Verdict:
Malicious
File Type:
ps1
First seen:
2026-03-10T13:35:00Z UTC
Last seen:
2026-04-26T21:48:00Z UTC
Hits:
~100
Detections:
Trojan.Script.vjWorm.a Trojan.MSIL.Dnoper.sb Trojan.vjWorm.HTTP.C&C Trojan.PowerShell.Persik.sbr Trojan.PowerShell.Agent.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206
Verdict:
Malware
YARA:
3 match(es)
Tags:
Base64 Block Contains Base64 Block PowerShell Powershell: Hidden Execution
Link:
https://app.malva.re/file/623b6d9b9d4022ed5613ac13444adb7a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206/
Verdict:
Malicious
Threat:
Trojan.PowerShell.Persik
Link:
https://tip.neiki.dev/file/c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206
Threat name:
Script-PowerShell.Trojan.Pantera
Create hunting rule
Status:
Malicious
First seen:
2026-03-10 16:46:00 UTC
File Type:
Text (PowerShell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yiejgfhsjzm6z36mzerwur2o7hhh6h47p7czp4qqxrljgj3vmida._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion execution persistence
Link:
https://tria.ge/reports/260426-se89aacx3n/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Adds Run key to start application
Hide Artifacts: Hidden Window
Drops startup file
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_FileFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects FileFix social engineering technique that launches chained PowerShell and PHP commands from file explorer typed paths
Reference:FileFix social engineering with PowerShell and PHP commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments