MALICIOUS — d947e4cc8c8c5d7cc6dbb1e38cea7e50133e3032bd943bc1ff4eefd11f5f1a8d.ps1

MALICIOUS — d947e4cc8c8c5d7cc6dbb1e38cea7e50133e3032bd943bc1ff4eefd11f5f1a8d.ps1 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PowerShell family. 5 of 51 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: d947e4cc8c8c5d7cc6dbb1e38cea7e50133e3032bd943bc1ff4eefd11f5f1a8d
SHA-1: 58bf80ed34585fb7e0ad90185b151f9255ccad16
MD5: 597a5092a1c506db538526df16760a71
ssdeep: 48:KezGigGImaG/goZ3ulYtSmQKTtSJRUOw1xfbekdMETVanCWHRMmYtcofmHSCnn:CiZ+Nh74NjdPTVHWyTfevn
TLSH: T1071586E59C454C8084CF0E5A2735DFBE9B1A688D0BB2484B67D20B1478D46C09E5A48D
Submitted as: d947e4cc8c8c5d7cc6dbb1e38cea7e50133e3032bd943bc1ff4eefd11f5f1a8d.ps1
File type: script · Size: 2536 bytes
Verdict: malicious (100/100) · Family: PowerShell

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (5 of 51 engines)

YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
capa (capabilities): execute via PowerShell
YARA: MalwareAnalyser community pack: TL_Suspicious_PowerShell_Download
Microsoft Defender: HackTool:PowerShell/PsAttack.E
Emsisoft (Emergency Kit): CMD:Heur.BZC.PZQ.Boxter.841.EB12F5B0

MITRE ATT&CK

YARA

Suspicious_PowerShell_Download_Exec

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

Encoded/hidden PowerShell download-and-exec (rule Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90
1 behavioral detection(s): Download-and-execute dropper (wget/curl + chmod) [high] (rule tl-linux-download-exec) - dynamic signal, weight 0.60, confidence 0.90
1 behavioral detection(s): Download-and-execute dropper (wget/curl + chmod) [high] (rule tl-linux-download-exec) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged HackTool:PowerShell/PsAttack.E (rule HackTool:PowerShell/PsAttack.E) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged CMD:Heur.BZC.PZQ.Boxter.841.EB12F5B0 (rule CMD:Heur.BZC.PZQ.Boxter.841.EB12F5B0) - engine signal, weight 0.55, confidence 0.85
Obfuscated powershell script: download, dynamic-exec, hidden-window, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser community pack flagged TL_Suspicious_PowerShell_Download (rule TL_Suspicious_PowerShell_Download) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://ipinfo.io/ip - static signal, weight 0.35, confidence 0.60
Contacted 3 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Contacted 3 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

875 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

tmp_tmp.YRNQadXIVT - feb0566f5663155063b35e7659f0dedb6cafcc0dc5fe8533c007d25ab2acf55c

Embedded URLs

http://ipinfo.io/ip

Embedded domains

ipinfo.io
entropy.ubuntu.com
ntp.ubuntu.com
_dosvc._tcp.local
desktop-hsgcbep._dosvc._tcp.local

Embedded IP addresses

185.125.189.52
185.125.190.58

More PowerShell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report