MALICIOUS — 9efc2a7dbea837926cea410b39c91d496e66390f6d7792d868d29130c87a5b87

MALICIOUS — 9efc2a7dbea837926cea410b39c91d496e66390f6d7792d868d29130c87a5b87 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100), attributed to the Base64 family. 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 9efc2a7dbea837926cea410b39c91d496e66390f6d7792d868d29130c87a5b87
• SHA-1: 34732522856006ea5c654ce1256927da3fdcaeeb
• MD5: d71dfbaed0ef52ff1953459cd6f4f7f4
• ssdeep: 96:xDT6T/vXhDGR8jyhwjYi44JXN3bupZAlj/V5lIZU4h4Elj3nL+SaTwMXh0:5qvXhjyhwcS7ywd47B53LKTwMXh0
• TLSH: T10C1D7E096D71FFA60C54AF22425F36CAC2E061248002F1D0F9D59079AE7AF753D65BA2
• Submitted as: 9efc2a7dbea837926cea410b39c91d496e66390f6d7792d868d29130c87a5b87
• File type: script · Size: 6265 bytes
• Verdict: malicious (70/100) · Family: Base64

Detections (5 of 50 engines)

• capa (capabilities): capability:execution/powershell
• YARA: MalwareAnalyser community pack: TL_Base64_EncodedCommand
• Microsoft Defender: Trojan:PowerShell/Rozena.HNAB!MTB
• Emsisoft (Emergency Kit): Trojan.Generic.32238742
• Kaspersky (KVRT): HEUR:Trojan.PowerShell.Generic

MITRE ATT&CK

• T1059.001

Why this verdict

The malicious score of 70/100 is the fusion of 3 weighted signals:

• Obfuscated powershell script: shellcode-injection (layers: powershell-encodedcommand+base64) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: MalwareAnalyser community pack flagged TL_Base64_EncodedCommand (rule TL_Base64_EncodedCommand) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

File paths

• C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\

More Base64 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report