MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b
SHA3-384 hash: 5f5eda6aacb6bea47a2f13b53ed58e61fa291094645ba631c2a4e6156769dd66968b29ec6fda291929e557d2b8a6a068
SHA1 hash: 00abc9504092e3633043e1af4694b3b2ad182c77
MD5 hash: a77131589140659ce0d41f3f7c74375d
humanhash: asparagus-juliet-lima-oven
File name:puk3ta8cyv1.ps1
Download: download sample
File size:794'028 bytes
First seen:2026-04-01 21:45:50 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 6144:ZeNdvU55puGsnoc8Tii1luGeJ3bYncqGaHgPJC4eVdHMEnZP/0Xr+myqpESAMtaI:INdc55pfy8vkGzzGan4eIYJ/0ty/+V
Threatray 131 similar samples on MalwareBazaar
TLSH T15CF46C2EAF53BF9B9C8222F1D7975ACCEAA4025A439356987D7CE6443C4CC6803DC59C
Magika powershell
Reporter aachum
Tags:158-94-211-65 Arechclient2 dropped-by-LummaStealer ps1 SectopRAT


Avatar
iamaachum
https://kalitkajony.pw/puk3ta8cyv1

SectopRAT/Arechclient2 C2: 158.94.211.65

Intelligence

File Origin
# of uploads :
1
# of downloads :
45
Origin country :
US US
Vendor Threat Intelligence
Gathering data
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69cd910c3a18a6e1ddf07371
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 powershell
Link:
https://www.filescan.io/uploads/69cd922700ad36369409f49b/reports/22b0df17-89be-48d6-a6d9-04fab314d6e4/overview
Verdict:
Malicious
Labled as:
PowerShell/Agent.DYW trojan
Link:
https://www.hybrid-analysis.com/sample/e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b
Result
Gathering data
Verdict:
Malicious
File Type:
ps1
First seen:
2026-03-31T16:43:00Z UTC
Last seen:
2026-04-01T18:45:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.PowerShell.Obfus.gen
Link:
https://opentip.kaspersky.com/e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1892504
Signature
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
90%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b/
Verdict:
Malicious
Threat:
Family.ARECHCLIENT2
Link:
https://tip.neiki.dev/file/e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=43hu3d3lwp6mjezsx6auigydv76b3dg4d56mg2gyvnztgphzmq5q._file
Verdict:
malicious
Label(s):
sectoprat
Create hunting rule
Similar samples:
46d30acdb729ca35aefeac6e5ab5e00cf8c2ec823e922e8aebe82a412e832336
72c08e044dd427964bc14339f95838e3d45f51f6a586330c683fbb59ea374b1d
error
+ 121 additional samples on MalwareBazaar
Result
Malware family:
sectoprat
Create hunting rule
Score:
  10/10
Tags:
family:sectoprat discovery execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/260401-1mqe5sgy3p/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Time Discovery
Adds Run key to start application
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Badlisted process makes network request
SectopRAT
SectopRAT payload
Sectoprat family
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PowerShell (PS) ps1 e6cf4d8f6bb3fcc49332bf81441b03affc1d8cdc1f7cc368d8ab73333cf9643b

(this sample)

zip 4011f4fdfaa71572c649941f289fef31eff80f6ec793406614e8e6c9c3417330

  
Link
https://tria.ge/260401-1ek6fsgx7m/behavioral1
  
Dropped by
LummaStealer
  
Delivery method
Distributed via web download
  
Dropping
SHA256 4011f4fdfaa71572c649941f289fef31eff80f6ec793406614e8e6c9c3417330
  
Dropping
MD5 450d3bc01d4170977d53a176d7765c22

Comments