MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268
SHA3-384 hash:	468437a28e7941ef3d38b03046d2f22a5a9e03d0d753d010de9f5747485edd70c94bbd78281869bc03a065e1eedaeffe
SHA1 hash:	912138d93e657bb9d3c69cf2764cc809ee6cd730
MD5 hash:	5d1208ad479e0b72ad2eebf849bee0d4
humanhash:	kentucky-wolfram-hydrogen-equal
File name:	tmp1E22.tmp.ps1
Download:	download sample
File size:	1'620 bytes
First seen:	2026-04-26 02:29:53 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	48:lkLzqRowIX6nVxVYyeMDra37vOPmfqHX4AfMHt:Qz8owIX6VxbDrarGPmSHVfMHt
TLSH	T1D03191912BE91204F2F77F457E7E84684A3B3C25DE31CB4C42A5194E06F2E60C866F7A
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	powershell
Reporter	BastianHein
Tags:	ps1

Intelligence

File Origin

# of uploads :

# of downloads :

138

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ed78be4aed15d079308538

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade penguish powershell

Link:

https://www.filescan.io/uploads/69ed78bfc06ec088bf5eba3b/reports/4d45fc17-f476-41b0-beb5-0559cbe72645/overview

Verdict:

Malicious

Labled as:

PowerShell/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268

Verdict:

Malicious

File Type:

ps1

First seen:

2026-04-14T10:47:00Z UTC

Last seen:

2026-04-25T23:43:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Strab.sb Trojan.Win32.Penguish.sb HEUR:Trojan.OLE2.Alien.gen

Link:

https://opentip.kaspersky.com/f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268/results?tab=lookup

Score:

40%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated PowerShell

Link:

https://app.malva.re/file/5d1208ad479e0b72ad2eebf849bee0d4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268/

Verdict:

Malicious

Threat:

Trojan.Win32.Strab

Link:

https://tip.neiki.dev/file/f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268

Threat name:

Script-PowerShell.Downloader.Malgent

Status:

Malicious

First seen:

2026-04-26 03:40:35 UTC

AV detection:

8 of 24 (33.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6pgjl4jvk53d74r4fn2tpilqr4f3g65e3swxcb66xwnjchn74jua._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution

Link:

https://tria.ge/reports/260426-czd1wacv8x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.