MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2a9ff09fd820456ef2d9d55f6f0f65206b6227380138a128efbd78fd1e5a71f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f2a9ff09fd820456ef2d9d55f6f0f65206b6227380138a128efbd78fd1e5a71f
SHA3-384 hash:	9c278a046ef707336df30298095d5f093e4ba9e2ab5cab15651cfa3c45752bf685ee08405f2e2ed186f93d9fb9c4c0ae
SHA1 hash:	40d18ff8926fa6b900b053df6dc4d1827f9a7ecc
MD5 hash:	8103d72baaa280a7a5230f1fd4d8f571
humanhash:	magnesium-oscar-vegan-october
File name:	teeeessssssss.ps1
Download:	download sample
File size:	514'741 bytes
First seen:	2025-05-27 16:09:54 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12288:vN+kH81VBetHa59IV2UGXv4rAQRC99yvhk/MVGXM60pt0Zg3GRGY:wkczBCHakV2zfwZogvu/qGX8pt92QY
TLSH	T159B423212B35345FA078240DD67BEF08A7F4D78560E9F4C14BFA72BD219CF22A35A921
Magika	powershell
Reporter	JAMESWT_WT
Tags:	176-65-142-252 ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

71

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.15322.16104.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6835e551668438e362e77543

Tags:

spawn blic

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

base64 dropper obfuscated

Link:

https://www.filescan.io/uploads/6835e3eee336a33801def7e3/reports/09d95b04-eb20-4a6a-9e8d-952319532017/overview

Hybrid Analysis PowerShell/TrojanDropper.Agent

Verdict:

Malicious

Labled as:

PowerShell/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/f2a9ff09fd820456ef2d9d55f6f0f65206b6227380138a128efbd78fd1e5a71f

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1700005

Signature

AI detected malicious Powershell script

Antivirus detection for dropped file

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Powershell drops PE file

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f2a9ff09fd820456ef2d9d55f6f0f65206b6227380138a128efbd78fd1e5a71f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f2a9ff09fd820456ef2d9d55f6f0f65206b6227380138a128efbd78fd1e5a71f/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.AgentTesla

Threat name:

Script-PowerShell.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-27 16:02:43 UTC

File Type:

Text

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ku76cp5qicfn3zntvk7n4hwkidlmittqajyueuo7ply7upfu4pq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250527-tmha7sal3w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f2a9ff09fd820456ef2d9d55f6f0f65206b6227380138a128efbd78fd1e5a71f