MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9f8f00997f3a67cf91c0a9aeb2b0fdedadab243fb75d30f6ae69c7b1dcbb7d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e9f8f00997f3a67cf91c0a9aeb2b0fdedadab243fb75d30f6ae69c7b1dcbb7d0
SHA3-384 hash:	d48d6c7b798543b2c20c5359313f7fcb6c270107fd2cec4e39fdb4cf69ecfed70368081ca91f04f86f66614f40c9b644
SHA1 hash:	82659281b62940fd3ce39a0a5fe97d95e32c5139
MD5 hash:	a396dcde8e105794bd95723ab42c8394
humanhash:	green-indigo-oklahoma-ten
File name:	b
Download:	download sample
File size:	2'298 bytes
First seen:	2026-09-23 18:08:50 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	48:b/Cfdu0duvu/fuPu6uBu4umFuuPiuvurununuEuxuwuSudJ23idudG8dza:xbWe2b4xmkurWquuFIpzdJ2SEM89a
TLSH	T1F7415E8E314144A2C07531B4374E0E82A38AA76B5A5BFFF1A0D17968BC1BDA193777C5
Magika	batch
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://gerlace[.]com/leagek2u.js (ClickFucker) --> hXXps://gerlace[.]com/api/v1/8e4c615 (token) --> hXXps://gerlace[.]com/api/v1/f659473 (gateway) --> hXXps://gerlace[.]com/api/v1/e81929c (clipboard) --> hXXps://appkey5484[.]com/b (cmd)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

5

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ab4afa1af71e9f5fe01aa43/reports/e5299c01-2c22-4b9e-9c4a-48439a4f512f/overview

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

unix shell

Link:

https://opentip.kaspersky.com/e9f8f00997f3a67cf91c0a9aeb2b0fdedadab243fb75d30f6ae69c7b1dcbb7d0/results?tab=lookup

Nucleon Malprob Benign

Score:

28%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/e9f8f00997f3a67cf91c0a9aeb2b0fdedadab243fb75d30f6ae69c7b1dcbb7d0

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5h4pacmx6othz6i4bknowkyp33nnvmsd7n25gd3k42ohwholw7ia._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e9f8f00997f3a67cf91c0a9aeb2b0fdedadab243fb75d30f6ae69c7b1dcbb7d0