Open-source atomic malware analysis

Analyze another

MSFT_AADGroup.psm1

POWERSHELL
Verdict: BENIGN
SHA256: d00b9dcd314865d918ccc3c7e144092db720eccab4c5ae59941925afee387602
Mal-ecule
O(C)H(Cm)
Size 40.4 KB download unavailable
First seen 73 days ago
Analyzed 69 days ago

Objectives

notable severity, 90% confident.
command-and-control/channel/deaddrop Microsoft Graph mailbox client
component severity, 94% confident.
command-and-control/backdoor/tasking Regex component marker
component severity, 95% confident.
command-and-control/dropper/execution Regex component marker
component severity, 95% confident.
evasion/indicator-removal Regex component marker
component severity, 100% confident.
exfiltration/cloud Regex component marker

Micro-behaviors

notable severity, 75% confident.
communications/http/lib HTTP/HTTPS URL literal
baseline severity, 90% confident.
communications/http HTTPS protocol prefix
component severity, 100% confident.
data/text/keywords "Environment" keyword

Metadata

baseline severity, 100% confident.
lang Valid PowerShell code
component severity, 90% confident.
file/text File has 30 or more lines

Identity

SHA-256 d00b9dcd314865d918ccc3c7e144092db720eccab4c5ae59941925afee387602
Filename MSFT_AADGroup.psm1

Origin

Source harvest

Timeline

First seen 4 Jun 2026 23:20 UTC
First analyzed 9 Jun 2026 15:35 UTC
Last analyzed 9 Jun 2026 15:35 UTC
Last updated 9 Jun 2026 15:35 UTC

Labeling

Label bad
Label source harvest
Traits version 6c97d