SUSPICIOUS — 61351d869940b9875400bf4ebd1bdc29f972813473a823acc85db242487212bc.ps1

SUSPICIOUS — 61351d869940b9875400bf4ebd1bdc29f972813473a823acc85db242487212bc.ps1 is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (64/100). 3 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 61351d869940b9875400bf4ebd1bdc29f972813473a823acc85db242487212bc
• SHA-1: adb10affd67132d102a5b8a5ccb3282fd65c579e
• MD5: 9e0ce52338351211fec9443046441d03
• ssdeep: 192:wgxCP15F6XA171xfM9Vu6p6K9nTOvR/SgP/ZLaRJ9RgW:w8CPdfMUZJtZLaZKW
• TLSH: T102235E0D560F83E76389705B003E58ACD08389CBD237E6FE5C4876E79B958C1AB36460
• Submitted as: 61351d869940b9875400bf4ebd1bdc29f972813473a823acc85db242487212bc.ps1
• File type: unknown · Size: 10771 bytes
• Verdict: suspicious (64/100)

Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified

Detections (3 of 51 engines)

• capa (capabilities): capability:execution/powershell
• Microsoft Defender: Trojan:PowerShell/Obfuse.DRH!MTB
• Emsisoft (Emergency Kit): Trojan.Generic.40345323

MITRE ATT&CK

• T1059.001

Why this verdict

The suspicious score of 64/100 is the fusion of 2 weighted signals:

• Microsoft Defender flagged Trojan:PowerShell/Obfuse.DRH!MTB (rule Trojan:PowerShell/Obfuse.DRH!MTB) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report