🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2559b4387f13d84b7086abb959bca7defaeaac08744c4b57681e3924d0c47607. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2559b4387f13d84b7086abb959bca7defaeaac08744c4b57681e3924d0c47607
SHA3-384 hash: 46732faa33e130351f900b87b292c08142754d5c70ae2eeac0d10f7b51a063d8dacdc51be82544c32a1970b19c2bebe3
SHA1 hash: ecd865637e51386e6070c7ea1f361e4259832de9
MD5 hash: d18b7fc7d9d213aa3ddb3cd3fe1bf60c
humanhash: avocado-leopard-mockingbird-autumn
File name:cmd
Download: download sample
File size:11'224 bytes
First seen:2026-09-28 06:49:06 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 96:B0rbT3ppOmKhKwGDchYKfYU4FaxOzIKaNNwaqBkvLLJFC1QkqU4mPedXfQhPxNPZ:WCqwGA4o8sNNwV2LLJ87QvQ/4fg6cwQ
TLSH T168321123113A855BF8604DEB92AB4247F7E7655B280DBBF0119009CCD6829AF3FD64E7
Magika batch
Reporter smica83
Tags:bat

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
bat
Verdict:
Suspicious activity
Analysis date:
2026-09-28 07:37:23 UTC
Tags:
smtp
Link:
https://app.any.run/tasks/47c2c577-6d6f-4457-84d8-04b933b40ac8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/89404/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Running batch commands
Launching a process
Creating a file
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Launching cmd.exe command interpreter
Сreating synchronization primitives
Sending an HTTP GET request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd downloader evasive findstr lolbin ping powershell wmic
Link:
https://www.filescan.io/uploads/6aba17c300cc376ff448f25c/reports/e8da3ce6-6a3e-4295-ac1e-3ea934611fb9/overview
Verdict:
Malicious
Labled as:
PowerShell/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/2559b4387f13d84b7086abb959bca7defaeaac08744c4b57681e3924d0c47607
Verdict:
Unknown
File Type:
unix shell
Link:
https://opentip.kaspersky.com/2559b4387f13d84b7086abb959bca7defaeaac08744c4b57681e3924d0c47607/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1978816
Signature
Bypasses PowerShell execution policy
Joe Sandbox ML detected suspicious sample
Powershell connects to network
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: PowerShell DownloadFile
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1978816 Sample: cmd.bat Startdate: 28/09/2026 Architecture: WINDOWS Score: 84 31 xemhang.vn 2->31 33 sancovat.vn 2->33 35 2 other IPs or domains 2->35 49 Sigma detected: PowerShell DownloadFile 2->49 51 Joe Sandbox ML detected suspicious sample 2->51 53 Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder 2->53 55 2 other signatures 2->55 8 cmd.exe 7 2->8         started        12 svchost.exe 1 1 2->12         started        signatures3 process4 dnsIp5 29 C:\Users\Publicbehaviorgraphm_sv.ps1, ASCII 8->29 dropped 57 Suspicious powershell command line found 8->57 59 Uses ping.exe to sleep 8->59 61 Tries to download and execute files (via powershell) 8->61 63 2 other signatures 8->63 15 powershell.exe 15 8->15         started        19 powershell.exe 14 16 8->19         started        21 powershell.exe 8->21         started        23 7 other processes 8->23 37 127.0.0.1 unknown unknown 12->37 file6 signatures7 process8 dnsIp9 39 pro13.emailserver.vn 103.110.129.113, 49703, 587 AXYS-VNRoom150815thFloorVincomCenterBuilding72LeThanhTonBenNgheWardDistrict1HoChiMinhCityVietnamVN Vietnam 15->39 47 Powershell connects to network 15->47 41 xemhang.vn 118.70.144.70, 49713, 80 FPT-AS-APFPTTelecomCompanyVN Vietnam 19->41 43 sancovat.com 74.119.239.234, 80 UNIFIEDLAYER-AS-1-UnifiedLayerUS United States 21->43 45 192.168.1.1 unknown unknown 23->45 25 WMIC.exe 1 23->25         started        27 findstr.exe 1 23->27         started        signatures10 process11
Score:
47%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/2559b4387f13d84b7086abb959bca7defaeaac08744c4b57681e3924d0c47607
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2559b4387f13d84b7086abb959bca7defaeaac08744c4b57681e3924d0c47607/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=evm3iod7cpmew4egvo4vtpfh335ovlaiorgewv3idy4sjugeoydq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution
Link:
https://tria.ge/reports/260928-jcgxksybqg/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Network Configuration Discovery: Internet Connection Discovery
Drops file in System32 directory
Command and Scripting Interpreter: PowerShell
Enumerates connected drives
Badlisted process makes network request
Malware Config
Dropper Extraction:
http://xemhang.vn/Website1/Download/Svsc.txt
http://sancovat.vn/Website1/Download/Svsc.txt
http://sancovat.com/Website1/Download/Svsc.txt
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2559b4387f13d84b7086abb959bca7defaeaac08744c4b57681e3924d0c47607

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/89404/

Comments