MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065
SHA3-384 hash:	2a5896ada21a97dd0c8264a67fb3f7916ead19e5c6617dd839dcc2cff07e1d5c8f84586beb41933a72393fc7aa16bf12
SHA1 hash:	dd1b37d276ed450ae055e228fb19b64f3c9db778
MD5 hash:	64bba2b2dd21188ee6cb1c0076ee014b
humanhash:	tennessee-nevada-one-lion
File name:	ps1010.ps1
Download:	download sample
File size:	99'508 bytes
First seen:	2024-11-22 08:17:50 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	1536:1XsJ4sYiWUUchrHNF7HJGm8o18lWW80J8SasOaSS:1Xs+sBNH/pAo1XySkj
TLSH	T1BBA37E398A867FF6172E2848950C6D401D983AA793699246DB4CF1737ADE430CFBC4BD
Magika	powershell
Reporter	Joker
Tags:	malware ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

87

Origin country :

GR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.Base64EXE-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67403f33d0583382434a67ed

Tags:

virus gates hllp

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated virus

Link:

https://www.filescan.io/uploads/67403e428d2018acf26372f0/reports/13dd255a-f228-4bf1-825e-4167e2ce7616/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1560746

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

76%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065/

ReversingLabs TitaniumCloud Win32.Virus.Pardona

Threat name:

Win32.Virus.Pardona

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-19 17:13:00 UTC

File Type:

Text

AV detection:

22 of 38 (57.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=36ilqwhl7atubtqtj62zc67mxmzyl5g7ynwl4kgw5edqtxyb6bsq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/241122-j6958atkbq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065