🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09c8e61d495491b45c76ebf52e45b3ed5a3c1ffe16ef965e32f95c89181e8606. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09c8e61d495491b45c76ebf52e45b3ed5a3c1ffe16ef965e32f95c89181e8606
SHA3-384 hash: 858adb1024f6c5f0bc147770bab8d838feeb433ff21e5e323459bf0b3adb02922ddfb61d2a77ab5ee29749c740315974
SHA1 hash: d2dc20acf17d9e80b484dd393f2fe08967495519
MD5 hash: 1f3e4a619c8f8d5ccde8b0797a9109ba
humanhash: alanine-alabama-queen-neptune
File name:idk_obfuscated.bat
Download: download sample
File size:5'037 bytes
First seen:2026-10-28 21:46:53 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 96:GClkNKzHc33RD82i3i8iRidHin3xTLXW7dCeXkQyCDzmXwl980R3wpi9IWAyJwqT:LlkIzH+Rw2QHaWQhTLXW78eXkQyCDzmw
TLSH T108A130123EE6AC67D07DDC91B4EB5212E798F5CB24523AF052D930D4E82620A4B79DEC
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika batch
Reporter smica83
Tags:bat HUN

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
bat
Verdict:
Malicious activity
Analysis date:
2026-10-28 21:56:41 UTC
Tags:
uac-bypass evasion stealer
Link:
https://app.any.run/tasks/08885882-9d57-486e-8f1c-15a4a86a26a1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95786/
Detection(s):
Sanesecurity.Malware.BadBatObs.31934.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae26d633a56bbccb37c1959
Tags:
shell virus sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-security attrib evasive icacls mountvol net obfuscated powershell shutdown takeown taskkill timeout
Link:
https://www.filescan.io/uploads/6ae26d62ffded0a90efc8498/reports/7e42aacf-4d31-46ac-8e43-fec3428bca45/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/09c8e61d495491b45c76ebf52e45b3ed5a3c1ffe16ef965e32f95c89181e8606
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-28T20:11:00Z UTC
Last seen:
2026-10-28T20:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/09c8e61d495491b45c76ebf52e45b3ed5a3c1ffe16ef965e32f95c89181e8606/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1994258
Signature
Adds a directory exclusion to Windows Defender
Deletes shadow drive data (may be related to ransomware)
Disable Windows Defender real time protection (registry)
Joe Sandbox ML detected suspicious sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Security Service Disabled Via Reg.EXE
Suspicious powershell command line found
Uses bcdedit to modify the Windows boot settings
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1994258 Sample: idk_obfuscated.bat Startdate: 28/10/2026 Architecture: WINDOWS Score: 80 28 Sigma detected: Security Service Disabled Via Reg.EXE 2->28 30 Sigma detected: Powershell Defender Disable Scan Feature 2->30 32 Deletes shadow drive data (may be related to ransomware) 2->32 34 2 other signatures 2->34 7 cmd.exe 1 2->7         started        process3 signatures4 36 Suspicious powershell command line found 7->36 38 Uses cmd line tools excessively to alter registry or file data 7->38 40 Uses bcdedit to modify the Windows boot settings 7->40 42 Adds a directory exclusion to Windows Defender 7->42 10 reg.exe 7->10         started        13 reg.exe 7->13         started        15 bcdedit.exe 7->15         started        18 39 other processes 7->18 process5 file6 44 Disable Windows Defender real time protection (registry) 10->44 26 C:\empty, MS 15->26 dropped 20 conhost.exe 18->20         started        22 net1.exe 1 18->22         started        24 WmiPrvSE.exe 18->24         started        signatures7 process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09c8e61d495491b45c76ebf52e45b3ed5a3c1ffe16ef965e32f95c89181e8606/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-28 21:47:16 UTC
File Type:
Text (Batch)
AV detection:
4 of 38 (10.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bheomhkjksi3ixdw5p2s4rnt5vndyh76c3xzmxrs7foisga6qyda._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery evasion execution exploit ransomware trojan
Link:
https://tria.ge/reports/261028-1m9tsavse1/
Behaviour
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Executes a command shell one-liner
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Modifies Security services
Disables service(s)
Modifies file permissions
Stops running service(s)
Command and Scripting Interpreter: PowerShell
Possible privilege escalation attempt
Modifies boot configuration data using bcdedit
Modifies Windows Defender DisableAntiSpyware settings
Modifies Windows Defender Real-time Protection settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/09c8e61d495491b45c76ebf52e45b3ed5a3c1ffe16ef965e32f95c89181e8606

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CMD_Shutdown
Create hunting rule
Author:adm1n_usa32
Rule name:dgaaga
Create hunting rule
Author:Harshit
Description:Detects suspicious PowerShell or registry activity
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:SUSP_Script_PowerShell_Hidden_Launcher
Create hunting rule
Author:Marjoriefort
Description:Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:Veille fraicheur 2026-09-14 / cluster misses web
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/95786/

Comments