MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb4b59e792349e143519933eeb3312d407fc62c29eaf8e6021a4871ca5fe8ab0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cb4b59e792349e143519933eeb3312d407fc62c29eaf8e6021a4871ca5fe8ab0
SHA3-384 hash:	94b7a6efdc82a6048eb2c8168dbc10ca0a18755d286341af086c9917e000e41f01b51353eb2c748de1d3060d741a1d6d
SHA1 hash:	d8d1654b311504c67c24dc213e1d920f9ae00728
MD5 hash:	9194ffd16969d7ed632f348e43b02275
humanhash:	batman-november-mars-magazine
File name:	9.ps1
Download:	download sample
Signature	SharpHide Alert Create hunting rule
File size:	124'812 bytes
First seen:	2025-01-18 09:03:00 UTC
Last seen:	2025-01-20 17:07:30 UTC
File type:	ps1
MIME type:	text/plain
ssdeep	3072:TTieNC3EX6syh4ciFPTdTM2JiW0tDCfQHsQIOGL81wk5q+l5QhYUSX1AcbdxXSa5:T3NC3EKsyh4ciFTdTM2JiW0tDCfQHsQh
TLSH	T13DC32A321106BC4E9F7F1F85A84029A51CDC797BBB19C19CFBC907A9909A520DE7CEB4
Magika	powershell
Reporter	JAMESWT_WT
Tags:	85-209-11-15 booking ps1 SharpHide

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

114

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.10916.13938.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678b6f244487910100e02cd7

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

confuserex evasive net obfuscated

Link:

https://www.filescan.io/uploads/678b6e54202405e0396ff656/reports/19228994-5665-47e9-b773-8cd0b5001313/overview

Hybrid Analysis MSIL/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

MSIL/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/cb4b59e792349e143519933eeb3312d407fc62c29eaf8e6021a4871ca5fe8ab0

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded Powershell Directives

Detected one or more base64 encoded Powershell directives.

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox SharpHide

Result

Threat name:

SharpHide

Alert

Create hunting rule

Detection:

malicious

Classification:

adwa.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1594190

Signature

AI detected suspicious sample

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected Powershell download and execute

Yara detected SharpHide

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cb4b59e792349e143519933eeb3312d407fc62c29eaf8e6021a4871ca5fe8ab0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cb4b59e792349e143519933eeb3312d407fc62c29eaf8e6021a4871ca5fe8ab0/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.LummaStealer

Threat name:

Script-PowerShell.Trojan.LummaStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-18 09:02:25 UTC

File Type:

Text

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=znfvtz4sgspbinizsm7owmys2qd7yywct2xy4ybbusdrzjp6rkya._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/250118-kz15eaynaz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.