MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f61e953b18744be06991184c5d58a618ebcdb53c4a64ed0236e9e9300eb2aacf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f61e953b18744be06991184c5d58a618ebcdb53c4a64ed0236e9e9300eb2aacf
SHA3-384 hash:	703ec5bd2e9fbfab053ff2f7be148633869d618578830e3a1b79db9ccc0f8103bfbbf8964dbe9e251dfc6d42ed9e508b
SHA1 hash:	f226f133abc9cf138eef791bd046524d187d8e5b
MD5 hash:	6fffe8bb1d9464d007d32d886bce0817
humanhash:	maine-blossom-jupiter-three
File name:	agent3.ps1
Download:	download sample
Signature	AZORult Alert Create hunting rule
File size:	7'318 bytes
First seen:	2024-01-21 17:30:20 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	192:6vOuLf6+qUClbRZqwiJY5AH+W4BJeGZjf6H1XTMTqTn:6vQ+yo+yh
TLSH	T1F0E179E5BE1C45E419BB225CDF928882AD4DA57415F88501F6BE8C0BF79FE2480F1B0D
Reporter	rmceoin
Tags:	ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

195

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.14515.12648.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/65ad54d6dca4dca481df190f/reports/4cbd509a-74e5-4ecb-8307-061ba3379184/overview

Hybrid Analysis BZC.PZQ.Boxter.826

Verdict:

Malicious

Labled as:

BZC.PZQ.Boxter.826

Link:

https://www.hybrid-analysis.com/sample/f61e953b18744be06991184c5d58a618ebcdb53c4a64ed0236e9e9300eb2aacf

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1378324

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found suspicious powershell code related to unpacking or dynamic code loading

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

36%

Verdict:

Susipicious

File Type:

ASCII

Link:

https://malprob.io/report/f61e953b18744be06991184c5d58a618ebcdb53c4a64ed0236e9e9300eb2aacf

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f61e953b18744be06991184c5d58a618ebcdb53c4a64ed0236e9e9300eb2aacf/

ReversingLabs TitaniumCloud Win32.Trojan.Boxter

Threat name:

Win32.Trojan.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-01-20 21:11:17 UTC

File Type:

Text (PowerShell)

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ypjkoyyorf6a2mrdbgf2wfgddv43nj4jjso2arw5hutadvsvlhq._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/240121-v3pkwsfff9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Blocklisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.