🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 057c005a45f399f49f6be2aa59033df67f3cdd74c47c293400dbb8e3c63b2cef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 057c005a45f399f49f6be2aa59033df67f3cdd74c47c293400dbb8e3c63b2cef
SHA3-384 hash: 71be3cefe3c47f4617dee74798fc6574e8cff7b3585dcc4ca09e356e292b361c573f93470614e3ab5bf628c9f3136b99
SHA1 hash: a38373844647531133ea103224da78e737a32dd8
MD5 hash: 33afa6b3e4ff25e55b492f9265df4a15
humanhash: wisconsin-crazy-freddie-sad
File name:update_hab9r1i2iu.cmd
Download: download sample
File size:65'273 bytes
First seen:2026-10-13 12:49:05 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/x-msdos-batch
ssdeep 768:l1F+4TpmGEBz0G8cmeXmhaPRUG+59M69cS+d7QFaLWllio5s:IyE2GjmerPyf59M6+Vsly
TLSH T1B353AE2C6E932D7C9BB54B4916EC0DC15BAED7C3E713A2CD31126F185686746A6E30CC
Magika batch
Reporter smica83
Tags:cmd

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad123816f551121ba163d2a
Tags:
virus shell lien sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
attrib base64 evasive net obfuscated obfuscated ping powershell shutdown timeout
Link:
https://www.filescan.io/uploads/6ace28ccd6240128af20a213/reports/e3fcc23e-50ba-4aec-a2e6-c4586f7f7c34/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/057c005a45f399f49f6be2aa59033df67f3cdd74c47c293400dbb8e3c63b2cef
Verdict:
Unknown
File Type:
unix shell
Link:
https://opentip.kaspersky.com/057c005a45f399f49f6be2aa59033df67f3cdd74c47c293400dbb8e3c63b2cef/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1986491
Signature
Bypasses PowerShell execution policy
Disables virtualization based memory integrity
Inline Python code execution detected
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Obfuscated command line found
Powershell connects to network
Powershell drops PE file
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to download and execute files (via powershell)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal communication platform credentials (via file / registry access)
Tries to steal Crypto Currency Wallets
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1986491 Sample: update_hab9r1i2iu.cmd Startdate: 13/10/2026 Architecture: WINDOWS Score: 100 56 www.python.org 2->56 58 dualstack.python.map.fastly.net 2->58 60 2 other IPs or domains 2->60 70 Joe Sandbox ML detected suspicious sample 2->70 10 cmd.exe 1 2->10         started        signatures3 process4 signatures5 84 Suspicious powershell command line found 10->84 86 Obfuscated command line found 10->86 88 Uses ping.exe to sleep 10->88 90 6 other signatures 10->90 13 cmd.exe 3 10->13         started        17 powershell.exe 3 27 10->17         started        19 reg.exe 1 1 10->19         started        21 10 other processes 10->21 process6 file7 54 C:\Users\user\AppData\Roaming\...\cfg.dat, ASCII 13->54 dropped 92 Suspicious powershell command line found 13->92 94 Obfuscated command line found 13->94 96 Uses cmd line tools excessively to alter registry or file data 13->96 102 3 other signatures 13->102 23 powershell.exe 14 51 13->23         started        28 pythonw.exe 13->28         started        30 python.exe 13->30         started        34 5 other processes 13->34 98 Powershell drops PE file 17->98 100 Disables virtualization based memory integrity 19->100 32 net1.exe 1 21->32         started        signatures8 process9 dnsIp10 62 dualstack.python.map.fastly.net 151.101.0.223, 443, 49719 FASTLY-FastlyIncUS Canada 23->62 44 C:\Users\user\AppData\...\winsound.pyd, PE32+ 23->44 dropped 46 C:\Users\user\AppData\...\vcruntime140_1.dll, PE32+ 23->46 dropped 48 C:\Users\user\AppData\...\vcruntime140.dll, PE32+ 23->48 dropped 52 28 other malicious files 23->52 dropped 72 Powershell connects to network 23->72 64 api.ipify.org 104.26.13.205, 443, 49750 CLOUDFLARENET-CloudflareIncUS Canada 28->64 66 discord.com 162.159.128.233, 443, 49723, 49724 CLOUDFLARENET-CloudflareIncUS Canada 28->66 74 Tries to harvest and steal ftp login credentials 28->74 76 Tries to harvest and steal browser information (history, passwords, etc) 28->76 78 Tries to steal communication platform credentials (via file / registry access) 28->78 80 Tries to steal Crypto Currency Wallets 28->80 36 cmd.exe 28->36         started        38 cmd.exe 28->38         started        50 C:\Users\user\AppData\Roaming\...\s.py, Python 30->50 dropped 82 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 30->82 68 127.0.0.1 unknown unknown 34->68 file11 signatures12 process13 process14 40 conhost.exe 36->40         started        42 conhost.exe 38->42         started       
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/057c005a45f399f49f6be2aa59033df67f3cdd74c47c293400dbb8e3c63b2cef
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/057c005a45f399f49f6be2aa59033df67f3cdd74c47c293400dbb8e3c63b2cef/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-12 23:09:51 UTC
File Type:
Text (Batch)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=av6aawsf6om7jh3l4kvfsaz56z7tzxluyr6csnaa3o4ohrr3ftxq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
credential_access defense_evasion discovery execution spyware stealer
Link:
https://tria.ge/reports/261013-p2f98sdw5t/
Behaviour
Delays execution with timeout.exe
Runs net.exe
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Browser Information Discovery
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Network Configuration Discovery: Internet Connection Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
https://www.python.org/ftp/python/3.11.9/python-3.11.9-embed-amd64.zip
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/057c005a45f399f49f6be2aa59033df67f3cdd74c47c293400dbb8e3c63b2cef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:CMD_Shutdown
Create hunting rule
Author:adm1n_usa32
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments