🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a800ef0930eeeca1d5c5fb08b87e50552be9c0690d6945ddd855c84cdffa553. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a800ef0930eeeca1d5c5fb08b87e50552be9c0690d6945ddd855c84cdffa553
SHA3-384 hash: 53b7ebc64805f4183bb3c7e104b6e4fc4c98280dc8b0106a2170ef834d0bc12e024d1f870b9b7747edc71a68038514c6
SHA1 hash: e7577f0e44a7c6b885a8c0d6b8a37453089d3e07
MD5 hash: 7db0ba24be62fc8916a3c59d175347fd
humanhash: victor-fanta-wolfram-fillet
File name:y2b.bat
Download: download sample
File size:423 bytes
First seen:2026-11-14 06:50:39 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 12:YQ8yMT/Xhn4LuzFvG8yv5zF9N7ukVkNbl:YD9nDxkVkhl
TLSH T1EFE0EC1437BF14CDC228BCD05AAF92076E00BA593CB415339AB12068BD11943461DA4B
Magika batch
Reporter Latin

Intelligence

File Origin
# of uploads :
1
# of downloads :
12
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99939/
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af804e60a71acf937da8387
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2a800ef0930eeeca1d5c5fb08b87e50552be9c0690d6945ddd855c84cdffa553
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/2005833
Signature
Joe Sandbox ML detected suspicious sample
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2005833 Sample: y2b.bat Startdate: 14/11/2026 Architecture: WINDOWS Score: 48 17 Joe Sandbox ML detected suspicious sample 2->17 6 cmd.exe 2 2->6         started        process3 signatures4 19 Uses schtasks.exe or at.exe to add and modify task schedules 6->19 9 powershell.exe 23 6->9         started        11 powershell.exe 23 6->11         started        13 conhost.exe 6->13         started        15 2 other processes 6->15 process5
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/2a800ef0930eeeca1d5c5fb08b87e50552be9c0690d6945ddd855c84cdffa553
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a800ef0930eeeca1d5c5fb08b87e50552be9c0690d6945ddd855c84cdffa553/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fkaa54etb3xmuhk4l6yixb7favjl5hagsdljixo5qvoijtp7uvjq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution persistence
Link:
https://tria.ge/reports/261114-hmk7bawy2n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99939/

Comments