MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549
SHA3-384 hash:	f76785ec1b3606b3d739b5442c3f56751bcd618c584e1d75b220c8304ec84d6fa42aa088869d4c736a0ec14a01f98192
SHA1 hash:	5fa43f52f10b9151a08c5819b160e5b1a9c86f9e
MD5 hash:	be45df412ca9fa755320edd70ac5ac32
humanhash:	potato-berlin-pasta-muppet
File name:	ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549.ps1
Download:	download sample
File size:	2'164 bytes
First seen:	2026-05-12 10:25:13 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	48:zSvekXDhJkuPMf8VLSInAtoHiddWLQOIGnSO8iMzDXQVQxJ:zBkX9vVLJAqC72QUnvbM3QVm
TLSH	T14F41C6FF759478C7002C8127E2D1CE39267B62F95C9B9CDC0C64B64A1A16B04FA66C49
Magika	powershell
Reporter	JAMESWT_WT
Tags:	jicinvestments-monster ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

113

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0300299eb9b947bc033c54

Tags:

xtreme shell sage

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-20T02:23:00Z UTC

Last seen:

2026-05-12T11:57:00Z UTC

Hits:

~100

Detections:

UDS:DangerousObject.Multi.Generic HackTool.PowerShell.InvokeObfuscation.sb Trojan.Win32.Agent.sb HEUR:Trojan.PowerShell.Generic HEUR:HackTool.PowerShell.InvokeObfuscation.gen

Link:

https://opentip.kaspersky.com/ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549/results?tab=lookup

Nucleon Malprob Benign

Score:

26%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549/

Neiki HackTool.PowerShell.InvokeObfuscation

Verdict:

Malicious

Threat:

HackTool.PowerShell.InvokeObfuscation

Link:

https://tip.neiki.dev/file/ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Heuristic

Threat name:

Script-PowerShell.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-19 19:50:49 UTC

File Type:

Text (Batch)

AV detection:

6 of 24 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5tpy4uabapy2yxnkahz35uzokksoxj32vwkb6gjhgus6ca5muveq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260512-mf5plaez5n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549