MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b
SHA3-384 hash:	e52967c8e432ef1f4dbff013eb6adcfc0e15cf2b7e101f551e67987b072814a9f9518b96674734aae218501b1ce682fa
SHA1 hash:	b1a13a8bb1e3f763aacfe7f6090b2456496eeb97
MD5 hash:	453a4b09014e457346f4aa06d7e456de
humanhash:	jersey-whiskey-alpha-leopard
File name:	evidencelumber.bat
Download:	download sample
File size:	7'075 bytes
First seen:	2026-03-06 11:33:47 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	192:4UBmYXJjRm35n34+e3JC9n5o0HwJC8MkEGMJPvo96K8Xcca:4UBmkhS3re3JCJG0HwJC8vEvA9TgcV
TLSH	T1A1E12BFA81C861028F4757967B92BE8D765ADCB04363FC9E7D21618EC201B1ED821D77
Magika	batch
Reporter	JAMESWT_WT
Tags:	94-158-245-153 bat ink-approval-com

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

66

Origin country :

IT

Vendor Threat Intelligence

ACCE BatchScript_FileType

Malware configuration found for:

BatchScript

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f06278e1-7a0c-45cf-bc91-f83e2ecf8307/

ANY.RUN netsupport

Malware family:

netsupport

Alert

Create hunting rule

ID:

1

File name:

essay.zip

Verdict:

Malicious activity

Analysis date:

2025-09-10 16:17:01 UTC

Tags:

netsupport rmm-tool arch-exec remote tool

Link:

https://app.any.run/tasks/62869781-f4e7-499a-a1d2-236687108f1e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/55792/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-144.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6954244e7d915bf1778f117f

Tags:

injection netsup virus remo

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

lolbin persistence powershell reg schtasks

Link:

https://www.filescan.io/uploads/69aabbbbcd25bfe1dfe26116/reports/2a71e9d6-a7cd-4129-bf80-039ff2068406/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

Detections:

HEUR:Trojan.BAT.Obfus.gen

Link:

https://opentip.kaspersky.com/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b/results?tab=lookup

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b/

Neiki Trojan.BAT.Obfus

Verdict:

Malicious

Threat:

Trojan.BAT.Obfus

Link:

https://tip.neiki.dev/file/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-03-06 11:26:16 UTC

File Type:

Text (Batch)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f34vzuxpnnm63xbsqotx5ameil7tgcugagm4mgt6c3al2wzebenq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260306-nplhrads9l/

Behaviour

Modifies registry key

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: PowerShell

Registers new Windows logon scripts automatically executed at logon.

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/55792/