MALICIOUS — dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476.ps1

MALICIOUS — dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476.ps1 is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the PowerShell family. 4 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476
• SHA-1: 51a7a31c906c3db9907db443e8f1de66a5c6f253
• MD5: c0c9598bbdb6ff64c6f17e66caaec067
• ssdeep: 192:jkxVWnfrr+Fs/T9vQFRoZ1ZCMFm5HOpp4pW89Rrun0dxEzFu5CVPgCm:4xVWnfrKa/T9oFRoZDbFm5HOpp4pW891
• TLSH: T1D8245BED021FA3460325CB7939305AE58464F1E43A3DF3199E0BC2B12492467EDB76E9
• Submitted as: dff8f6d9784701f64c81cecfae1886b4751c1d87b945aff26d4422982b30c476.ps1
• File type: unknown · Size: 11530 bytes
• Verdict: malicious (94/100) · Family: PowerShell

Detections (4 of 51 engines)

• YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
• YARA: MalwareAnalyser community pack: TL_Suspicious_PowerShell_Download
• Microsoft Defender: Trojan:PowerShell/NetLoader.AD!AMTB
• Emsisoft (Emergency Kit): Trojan.Generic.40231398

MITRE ATT&CK

• T1059.001

YARA

• Suspicious_PowerShell_Download_Exec

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• Encoded/hidden PowerShell download-and-exec (rule Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90
• Microsoft Defender flagged Trojan:PowerShell/NetLoader.AD!AMTB (rule Trojan:PowerShell/NetLoader.AD!AMTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40231398 (rule Trojan.Generic.40231398) - engine signal, weight 0.55, confidence 0.85
• YARA: MalwareAnalyser community pack flagged TL_Suspicious_PowerShell_Download (rule TL_Suspicious_PowerShell_Download) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://pub-b066744732514fe6974e5655a609b606.r2.dev/xitoviskiskunitz.zip, http://151.240.151.126/dl-callback/wg868z9e/xitoviskiskunitz.zip/, 151.240.151.126 - static signal, weight 0.35, confidence 0.60

Embedded URLs

• https://pub-b066744732514fe6974e5655a609b606.r2.dev/xitoviskiskunitz.zip
• http://151.240.151.126/dl-callback/wg868z9e/xitoviskiskunitz.zip/

Embedded domains

• pub-b066744732514fe6974e5655a609b606.r2.dev

Embedded IP addresses

• 151.240.151.126

File paths

• C:\ProgramData\Zooms
• C:\Program

More PowerShell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report