MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4a9278c246d0b003ca6a355d2b6503091d74dc97d77250667898e94c296b3bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c4a9278c246d0b003ca6a355d2b6503091d74dc97d77250667898e94c296b3bd
SHA3-384 hash:	d95fd7077c909e8a7420acd629b710f80bd09fd5bde5319923169fc4a9534dfd89b6c214079f620c1eeaeb275b665474
SHA1 hash:	6ede90000656e98be008f3a52383f417885c3c14
MD5 hash:	0ee819a7c2cbe9786967c845cba88242
humanhash:	mars-item-venus-pennsylvania
File name:	ps1009.ps1
Download:	download sample
File size:	222 bytes
First seen:	2024-11-19 11:16:56 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	6:SxBT2AUhDexB3+/35BLu3q1qUoOAHC+lw3CVMBOe5fEgZOowyFbuxsn:11Di+/D6Cli5wWSOOsNyFbui
TLSH	T1D7D0A7EBC22F40D0425D91790C1A627D3449662592A22124DF19A849A5D53BD391CC15
Magika	powershell
Reporter	Joker
Tags:	malware ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

GR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PwrSh.ViperSoftX-D.3300.31002.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=673c75465107a56eacc7f15d

Tags:

virus shell gates

Hybrid Analysis Trojan.Agent

Verdict:

Malicious

Labled as:

Trojan.Agent

Link:

https://www.hybrid-analysis.com/sample/c4a9278c246d0b003ca6a355d2b6503091d74dc97d77250667898e94c296b3bd

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1558356

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Loading BitLocker PowerShell Module

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c4a9278c246d0b003ca6a355d2b6503091d74dc97d77250667898e94c296b3bd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c4a9278c246d0b003ca6a355d2b6503091d74dc97d77250667898e94c296b3bd/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.ViperSoftX

Threat name:

Script-PowerShell.Trojan.ViperSoftX

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-15 18:23:10 UTC

File Type:

Text

AV detection:

19 of 38 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ysuspdbenufqapfgunk5fnsqgci5otojpv3skbthrghjjquwwo6q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/241119-ndpe9svmfv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c4a9278c246d0b003ca6a355d2b6503091d74dc97d77250667898e94c296b3bd