MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VantaRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4
SHA3-384 hash: 6833928e117d2398b84cd741d268aa32a8f6a17051358896dc14075ca412171540facb40aa16a9f393c2d446673d9cb4
SHA1 hash: 467753ab0e90a99399b4dc9dab3543b1e17cb37d
MD5 hash: 7a2cca7b79606f125755ae7a28a53ae2
humanhash: idaho-oxygen-lion-snake
File name:WindowsUpdate1.bat
Download: download sample
Signature VantaRAT
Create hunting rule
File size:62'342 bytes
First seen:2026-06-16 11:58:01 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 768:nkCPd1Yg4FIqHE4nG/6zXi5nrXKYCdBHu1rlArK/K+33DhyaHQw:kCgnBG/QIrXKYYudCrgTFya7
TLSH T19253F47218C9311C04F699A90B606493572DC9ECEF9BD7FF76264AC1C92EB87FD20864
Magika batch
Reporter abuse_ch
Tags:bat RAT VantaRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/7f401962-d56a-4043-81cc-800a2bc5237f/
Malware family:
n/a
ID:
1
File name:
WindowsUpdate1.bat
Verdict:
Malicious activity
Analysis date:
2026-06-15 16:33:12 UTC
Tags:
ip-check evasion stealer python pyinstaller openssl tool
Link:
https://app.any.run/tasks/2197f9a7-8366-4e61-8a3b-e70ca0971710

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70954/
Detection(s):
SecuriteInfo.com.HEUR.Trojan.BAT.Alien.gen.11010.1213.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a302948a15110463ee614de
Tags:
emotet extens shell sage
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Launching a process
Creating a file in the %temp% directory
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Running batch commands
Loading a suspicious library
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug crypto encrypted expand lolbin powershell reconnaissance
Link:
https://www.filescan.io/uploads/6a313a66e6f7d2d27d581860/reports/004a0379-4269-48b2-a758-17536491bee1/overview
Verdict:
Malicious
Labled as:
BAT/TrojanDropper.Agent
Link:
https://www.hybrid-analysis.com/sample/0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-15T13:53:00Z UTC
Last seen:
2026-06-16T23:41:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-PSW.Python.Agent.gen HEUR:Backdoor.Python.Agent.gen PDM:Trojan.Win32.Generic HEUR:Trojan.BAT.Alien.gen HEUR:Trojan.Python.Tpyc.i HEUR:Trojan.Python.Rodico.gen HEUR:Trojan.Python.Pytr.bi
Link:
https://opentip.kaspersky.com/0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4/results?tab=lookup
Result
Threat name:
Discord Token Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1928718
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Contains functionality to infect the boot sector
Joe Sandbox ML detected suspicious sample
Powershell drops PE file
Sigma detected: Suspicious PowerShell Parameter Substring
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Discord Token Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1928718 Sample: WindowsUpdate1.bat Startdate: 16/06/2026 Architecture: WINDOWS Score: 92 47 vanta.st 2->47 49 icanhazip.com 2->49 51 api.ipify.org 2->51 61 Antivirus detection for URL or domain 2->61 63 Yara detected Discord Token Stealer 2->63 65 Sigma detected: Suspicious PowerShell Parameter Substring 2->65 67 Joe Sandbox ML detected suspicious sample 2->67 11 cmd.exe 1 2->11         started        signatures3 process4 signatures5 73 Bypasses PowerShell execution policy 11->73 14 powershell.exe 14 25 11->14         started        19 conhost.exe 11->19         started        process6 dnsIp7 57 vanta.st 185.178.208.158, 443, 49692, 49697 DDOS-GUARDRU Russia 14->57 43 C:\Users\user\AppData\Local\...\o1ciur.exe, PE32+ 14->43 dropped 45 C:\Users\user\AppData\Local\...\SPZbM8.exe, PE32+ 14->45 dropped 59 Powershell drops PE file 14->59 21 o1ciur.exe 239 14->21         started        25 conhost.exe 14->25         started        file8 signatures9 process10 file11 35 C:\Users\user\...\_yaml.cp310-win_amd64.pyd, PE32+ 21->35 dropped 37 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 21->37 dropped 39 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 21->39 dropped 41 154 other malicious files 21->41 dropped 69 Antivirus detection for dropped file 21->69 71 Contains functionality to infect the boot sector 21->71 27 o1ciur.exe 1 3 21->27         started        signatures12 process13 dnsIp14 53 icanhazip.com 104.16.185.241, 443, 49700, 49703 CLOUDFLARENET-CloudflareIncUS Canada 27->53 55 api.ipify.org 172.67.74.152, 443, 49699, 49702 CLOUDFLARENET-CloudflareIncUS Canada 27->55 75 Tries to harvest and steal browser information (history, passwords, etc) 27->75 77 Tries to steal Crypto Currency Wallets 27->77 31 cmd.exe 1 27->31         started        signatures15 process16 process17 33 conhost.exe 31->33         started       
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4/
Verdict:
Malicious
Threat:
Trojan.Python.Pytr
Link:
https://tip.neiki.dev/file/0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-06-15 16:33:16 UTC
File Type:
Text (Batch)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bqg6fnpjl5on3n4noz5cvtzjkceldqi2tbb5rgzx2m53mrx35p2a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
credential_access execution spyware stealer
Link:
https://tria.ge/reports/260616-n5eedadv9t/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Badlisted process makes network request
Downloads MZ/PE file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAT_Chunked_Payload_SetEnv
Create hunting rule
Author:marcin@ulikowski.pl
Description:Detects batch script storing chunks of payload in random environment variables
Rule name:obfuscated_BAT
Create hunting rule
Author:@warz_s
Description:Identifies obfuscated BAT files
Reference:https://github.com/secwarz/YaraRules

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/70954/

Comments