MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 30a06adece2fa5876271fef3f909639d4c707c1e45d1b5ae94e695a5d5839a12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 30a06adece2fa5876271fef3f909639d4c707c1e45d1b5ae94e695a5d5839a12 |
|---|---|
| SHA3-384 hash: | bfd331fa33f8c7670dbf0124523ceeef4e1aaf7eb8feaeb7e1df5b00dcea529545e06780b279079ed8ee541b90a91ea5 |
| SHA1 hash: | 1fe312bd78b7e3a9c0841027710993f2aed8e4d9 |
| MD5 hash: | 0621f262f8f4ef053dc7f73b0d3ea900 |
| humanhash: | uniform-bacon-speaker-nineteen |
| File name: | rt.bat |
| Download: | download sample |
| File size: | 265 bytes |
| First seen: | 2025-12-07 11:26:08 UTC |
| Last seen: | Never |
| File type: |  bat |
| MIME type: | text/x-msdos-batch |
| ssdeep | 6:hCr41E8SktxzMFCrjTF41R3IWFJ2HNW0C0YKH0rvNINmM5LEGmLI:LE81hM4bF41R2tW70MaNHmLI |
| TLSH | T190D09582061C50B6D664DD15531DB705DD47214522125EBC3EA4B1752F1F493C08F1D4 |
| Magika | batch |
| Reporter |  juroots |
| Tags: | bat |
Intelligence
File Origin
# of uploads :
1
# of downloads :
36
Origin country :
ILVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
https://www.valfanto.com/files/Comany_Profile_Order%20requirment_DEC_JAN2026_2025.zip
Verdict:
Malicious activity
Analysis date:
2025-11-27 20:36:45 UTC
Tags:
arch-exec python remote xworm arch-doc amsi-bypass
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
92.5%
Tags:
infosteal rapid
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Launching a process
Running batch commands
Creating a process with a hidden window
Сreating synchronization primitives
Creating a file
DNS request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
powershell
Verdict:
Suspicious
Labled as:
BAT/Runner.OP trojan
Verdict:
Clean
File Type:
unix shell
First seen:
2025-12-07T09:40:00Z UTC
Last seen:
2025-12-07T15:25:00Z UTC
Hits:
~10
Score:
10%
Verdict:
Benign
File Type:
SCRIPT
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
bat 30a06adece2fa5876271fef3f909639d4c707c1e45d1b5ae94e695a5d5839a12
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.