MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0802f6ec8278c7b05dcfcc763107f37f4e78c24d87d881f9fa36dfe6918a36e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f0802f6ec8278c7b05dcfcc763107f37f4e78c24d87d881f9fa36dfe6918a36e
SHA3-384 hash:	062664fddcc309df1932355682f6f3c6969c8f68c4d6599bb69a1df9b7e1790688befd187a5effb0035347818c03d054
SHA1 hash:	48e0b9a7650ff5b4294d6a5e6d4bdd6a113ffd1b
MD5 hash:	f44b774aac3ec4688531510b0c1eaf52
humanhash:	cold-tango-michigan-beer
File name:	download
Download:	download sample
Signature	KongTuke Alert Create hunting rule
File size:	19'664 bytes
First seen:	2025-01-06 18:07:24 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	384:bYPGNt7hmkZyaHP8Zt82RWkWFV0hFfHHGb4K/KFbAu2HFKy/:mGRF3P8Z62ZUV0hFfnVO2gFp
TLSH	T1D2926CB63B8DFDD2C58BD62D2607BC087F45746FE0E65AC4AF19D1C263026547B86C81
Magika	txt
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://ecrut[.]com/5r8k.js --> hXXps://ecrut[.]com/js.php (landing) --> hXXp://bfhdkgmmhdbikgj[.]top/1.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

148

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.23327.26255.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677c2971ffdcee13ec84d38d

Tags:

phishing trojan agent shell

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/677c1c03d3e0ca0ffef6889e/reports/5e619c36-d77f-4e7c-a309-88a3c0c3227e/overview

Hybrid Analysis Python/Kryptik.GA trojan

Verdict:

Suspicious

Labled as:

Python/Kryptik.GA trojan

Link:

https://www.hybrid-analysis.com/sample/f0802f6ec8278c7b05dcfcc763107f37f4e78c24d87d881f9fa36dfe6918a36e

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1584946

Signature

Loading BitLocker PowerShell Module

Queries Google from non browser process on port 80

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f0802f6ec8278c7b05dcfcc763107f37f4e78c24d87d881f9fa36dfe6918a36e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0802f6ec8278c7b05dcfcc763107f37f4e78c24d87d881f9fa36dfe6918a36e/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-01-06 19:01:05 UTC

File Type:

Text (PowerShell)

AV detection:

2 of 38 (5.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6cac63wie6ghwbo47tdwged7g72opdbe3b6yqh47unw742iyunxa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/250106-xn68hawphq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f0802f6ec8278c7b05dcfcc763107f37f4e78c24d87d881f9fa36dfe6918a36e