MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0
SHA3-384 hash:	6f444b37787d6a4cecb2abe8399664f96a78118975a70be39b2dfdd0b6315d1a3357eeb3ab2c945e8cabe9d6f4f2f6ef
SHA1 hash:	7a04209d104af348474df5bdea9bc0c9c76be9d5
MD5 hash:	f2a25274ea39301651d5291f6f83b7ea
humanhash:	sweet-india-saturn-glucose
File name:	search
Download:	download sample
Signature	KongTuke Alert Create hunting rule
File size:	5'604'610 bytes
First seen:	2026-03-18 16:10:32 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	24576:TqmLhriaw622zvRrdmdvmdvQkdvQ3+dvQ3aifdvQ3aibEdvQ3aibk2dvQ3aibkjK:2mLhrRzvRrwojtmNQvePtV+cwJCo8
TLSH	T14046F79EB64407F89994ABCD430731CE63A285372EBB104895E2864F7C2EF1376B5D78
Magika	powershell
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://voginc[.]com/58hgs.js --> hXXps://voginc[.]com/js.php (ClickFix) --> hXXps://afshapiro[.]com/search (Powershell)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

34

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Win.Downloader.Emmenhtal-10044033-0

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70.0%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69bae38693b644ca466b60de

Tags:

malware

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/69bae3814678eefbc7ae60dd/reports/6b91ee86-a391-47c3-8bc0-5167a8a1a184/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0

InQuest

Result

Gathering data

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Boxter

Threat name:

Script-PowerShell.Trojan.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-18 17:41:26 UTC

File Type:

Text

AV detection:

3 of 36 (8.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4fvw4uw626vmfal7mkdsp6x7lln43joiyq2byv3i5gqdkpkxrkqa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260318-v8z9ksgv6q/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0