MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe463c973906697ea6144ab27fcf30a6bb4296ac7876d3d69b466679767da009. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe463c973906697ea6144ab27fcf30a6bb4296ac7876d3d69b466679767da009
SHA3-384 hash: 10729541fe74071cc0971b3a7c41222818b35f33818ea912b68cb311ca130096022abfb69bafbe29a1b75cb119185a2d
SHA1 hash: 6b30cee41460edb86561c972c27fe952371e5422
MD5 hash: f6e251043fa9af56ab369eaea9c08a67
humanhash: eight-juliet-six-hydrogen
File name:a.ps1
Download: download sample
File size:3'398 bytes
First seen:2024-12-13 11:14:29 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 48:jh9623TFS2bGODtIb/rNFeeAVnOpqS2r21yvtsbJZeJxEVSQmS7/0Z7mxD03gBIc:CURsODtUDWhFgqVsVZGudmY/00D0QBdh
TLSH T18661BD0266E90008F6F7FA466B3E49B50FB37826AA79CD2C1180590E49F2B45BD50FF3
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika unknown
Reporter lontze7
Tags:ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
FR FR
Vendor Threat Intelligence
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=675c187b259e5b60544ef6ff
Tags:
shell virus sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/675c173c4bbf29372719fba8/reports/da9adf93-9aa9-4399-8107-0f20f9c1c357/overview
Verdict:
Malicious
Labled as:
PowerShell/Agent.CAF trojan
Link:
https://www.hybrid-analysis.com/sample/fe463c973906697ea6144ab27fcf30a6bb4296ac7876d3d69b466679767da009
Result
Verdict:
UNKNOWN
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1574587
Signature
AI detected suspicious sample
Loading BitLocker PowerShell Module
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Suricata IDS alerts for network traffic
Tries to open files direct via NTFS file id
Uses ipconfig to lookup or modify the Windows network settings
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1574587 Sample: a.ps1 Startdate: 13/12/2024 Architecture: WINDOWS Score: 72 34 Suricata IDS alerts for network traffic 2->34 36 AI detected suspicious sample 2->36 8 powershell.exe 16 43 2->8         started        process3 dnsIp4 30 154.90.62.248, 49710, 49726, 49749 CNSERVERSUS Seychelles 8->30 38 Uses ipconfig to lookup or modify the Windows network settings 8->38 40 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 8->40 42 Loading BitLocker PowerShell Module 8->42 12 powershell.exe 41 8->12         started        15 conhost.exe 8->15         started        signatures5 process6 signatures7 44 Tries to open files direct via NTFS file id 12->44 46 Loading BitLocker PowerShell Module 12->46 17 systeminfo.exe 2 1 12->17         started        20 query.exe 1 12->20         started        22 net.exe 1 12->22         started        24 3 other processes 12->24 process8 signatures9 32 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->32 26 quser.exe 1 20->26         started        28 net1.exe 1 22->28         started        process10
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/fe463c973906697ea6144ab27fcf30a6bb4296ac7876d3d69b466679767da009
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe463c973906697ea6144ab27fcf30a6bb4296ac7876d3d69b466679767da009/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7zddzfzzazux5jqujkzh7tzqu25uffvmpb3nhvu3izths5t5uaeq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/241213-ncjtdsykfq/
Behaviour
Gathers network information
Gathers system information
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates processes with tasklist
Blocklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fe463c973906697ea6144ab27fcf30a6bb4296ac7876d3d69b466679767da009

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PowerShell (PS) ps1 fe463c973906697ea6144ab27fcf30a6bb4296ac7876d3d69b466679767da009

(this sample)

  
Delivery method
Distributed via web download

Comments