MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2178aaaa78be8034bd09b3a9035e19cb82f48fd788d5afca3ee3938a729bf0ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2178aaaa78be8034bd09b3a9035e19cb82f48fd788d5afca3ee3938a729bf0ef
SHA3-384 hash:	219a42f556ff10afe614f83cbb9f82295c7dd19abe73c867b88a2de68b75941c8ba82da87bfb2e774486ff8730b50274
SHA1 hash:	f19e1dbf6cc2a487131252e90006aaae5b778ea3
MD5 hash:	1df4796dddf0f571dec78d45f7fd5eca
humanhash:	comet-carolina-black-delta
File name:	hehe.bat
Download:	download sample
File size:	1'334 bytes
First seen:	2025-09-13 15:08:04 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	24:id/IfpQbGx6t4A9FvKqtwH76h0hkLKyHqf8o4n8M5Jznvn8QimJQnvniO7:5QQ6t/vKqtwH76h9KYqf85n8kJLv8Qin
TLSH	T1C2219EBEDCB0F8C4436C7120D6163CAF20E55A2ACF721A6CF50428B27C64759DF2A68C
Magika	powershell
Reporter	CruelsisterA
Tags:	bat

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

57

Origin country :

US

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

hehe.bat

Verdict:

Suspicious activity

Analysis date:

2025-09-13 15:09:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f3b1a4a7-dab3-4e36-8979-566f23fd0a08

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/27310/

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.PowerShell.Agent-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c588e8d49ea3f1e4b517e0

Tags:

ransomware shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/68c588f2dbc6f5a29c436884/reports/bec4ec6a-d20d-40b3-9e44-459530fb87ba/overview

Hybrid Analysis Trojan.Text.Downloader

Verdict:

Malicious

Labled as:

Trojan.Text.Downloader

Link:

https://www.hybrid-analysis.com/sample/2178aaaa78be8034bd09b3a9035e19cb82f48fd788d5afca3ee3938a729bf0ef

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

ps1

Link:

https://opentip.kaspersky.com/2178aaaa78be8034bd09b3a9035e19cb82f48fd788d5afca3ee3938a729bf0ef/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2178aaaa78be8034bd09b3a9035e19cb82f48fd788d5afca3ee3938a729bf0ef/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/2178aaaa78be8034bd09b3a9035e19cb82f48fd788d5afca3ee3938a729bf0ef

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-09-13 15:09:21 UTC

File Type:

Text (Batch)

AV detection:

3 of 24 (12.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ef4kvktyx2adjpijwouqgxqzzobpjd6xrdk27sr64ojyu4u36dxq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/250913-sh512avxct/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2178aaaa78be8034bd09b3a9035e19cb82f48fd788d5afca3ee3938a729bf0ef

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/27310/