MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53
SHA3-384 hash:	0915df82c7401e6000bab128096af39038be043e9c7388a31c1acec08f2b46d18601709919be055789ebba295eb367e2
SHA1 hash:	eb242a7a24b74d24c45cd1a1913ed5cc25468267
MD5 hash:	793999bb681f3aff9111a842e411604c
humanhash:	steak-gee-paris-october
File name:	ps.ps1
Download:	download sample
File size:	56 bytes
First seen:	2026-05-25 11:13:20 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJFIGFBuIFldoEFI8EyOG+:s8GFBxFI8EzX
TLSH	T1599002745440575DDA4568199F34C5C055201181569235B62F4155CA1D60679E550995
Magika	batch
Reporter	JAMESWT_WT
Tags:	ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

304

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a142ed95b1db29f5a47a239

Tags:

trojan agent shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/6a142ed5056ea44c453a46da/reports/3b7a9529-5c84-4d84-9b98-3cb578f4096a/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-05-25T08:22:00Z UTC

Last seen:

2026-05-27T00:42:00Z UTC

Hits:

~10

Detections:

Trojan-Downloader.PowerShell.Small.ae

Link:

https://opentip.kaspersky.com/f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53/

Neiki Trojan-Downloader.PowerShell.Small

Verdict:

Malicious

Threat:

Trojan-Downloader.PowerShell.Small

Link:

https://tip.neiki.dev/file/f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7g75sw2kg7o3ajal6k2zkbkw7t2r4nd63i74klm2fdltjccup5jq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260525-nblxcset7n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53