🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a0b1c1477285cb20064e603d18096b693f05cd699fb024136a561f8215b559f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a0b1c1477285cb20064e603d18096b693f05cd699fb024136a561f8215b559f
SHA3-384 hash: 9d3c754ec212cf0efc6fdf84850194e7da9f4492812562b7cabe8789cc6507ce4089b134ffc1f3588b08a7ea5c800bdd
SHA1 hash: 46f7e3683e1211abf33354d5134c73b25e503b48
MD5 hash: dc3d7a9abf8bd9763d995370e919a8f5
humanhash: mexico-virginia-six-robert
File name:SoundGridDiagnostics.cmd
Download: download sample
File size:1'413'570 bytes
First seen:2026-10-12 06:44:57 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/x-msdos-batch
ssdeep 24576:MVjr3hBNQ0V8QwxPYo2uzp7xn4rrYjdJN3js:MJ/qYDc9A
TLSH T1DF658D3655123EBB3AD81A8CB8443AC40C6C65E78268DB94F889F727F7DD6084E9C17D
Magika batch
Reporter smica83
Tags:cmd

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection(s):
Win.Countermeasure.DotNetToJScript-9804890-0
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad0e608f4e17c78f715d12f
Tags:
dropper dotnet virus
Gathering data
Verdict:
Suspicious
Labled as:
Countermeasure.DotNetToJScript
Link:
https://www.hybrid-analysis.com/sample/3a0b1c1477285cb20064e603d18096b693f05cd699fb024136a561f8215b559f
Verdict:
Clean
File Type:
unix shell
First seen:
2025-10-27T22:25:00Z UTC
Last seen:
2026-10-14T04:40:00Z UTC
Hits:
~10000
Link:
https://opentip.kaspersky.com/3a0b1c1477285cb20064e603d18096b693f05cd699fb024136a561f8215b559f/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1985701
Signature
Command shell drops VBS files
Creates HTA files
Powershell drops PE file
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Legitimate Application Dropped Archive
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1985701 Sample: SoundGridDiagnostics.cmd Startdate: 12/10/2026 Architecture: WINDOWS Score: 88 54 Sigma detected: Legitimate Application Dropped Archive 2->54 56 Sigma detected: Suspicious Script Execution From Temp Folder 2->56 58 Sigma detected: Script Interpreter Execution From Suspicious Folder 2->58 9 cmd.exe 1 2->9         started        process3 signatures4 72 Suspicious powershell command line found 9->72 12 cmd.exe 21 9->12         started        16 conhost.exe 9->16         started        process5 file6 48 C:\Users\user\AppData\...\wavesversions.vbs, ASCII 12->48 dropped 50 C:\Users\user\AppData\...\pluginversions.vbs, ASCII 12->50 dropped 52 C:\Users\user\AppData\...\myverscript.vbs, ASCII 12->52 dropped 74 Suspicious powershell command line found 12->74 76 Command shell drops VBS files 12->76 78 Uses cmd line tools excessively to alter registry or file data 12->78 18 wscript.exe 12->18         started        22 certutil.exe 3 2 12->22         started        24 powershell.exe 28 12->24         started        26 27 other processes 12->26 signatures7 process8 file9 40 C:\Users\user\AppData\...\rad11678.tmp.hta, HTML 18->40 dropped 60 Windows Scripting host queries suspicious COM object (likely to drop second stage) 18->60 62 Creates HTA files 18->62 64 WScript reads language and country specific registry keys (likely country aware script) 18->64 28 mshta.exe 18->28         started        42 C:\Users\user\AppData\...\myprocdump.zip, Zip 22->42 dropped 66 Queries DNS domain through GetComputerNameExW (potential sandbox evasion) 22->66 44 C:\Users\user\AppData\Local\...\mysqlite3.exe, PE32 24->44 dropped 46 C:\Users\user\AppData\...\SGDiagsProgress.cmd, HTML 24->46 dropped 68 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 26->68 70 Powershell drops PE file 26->70 30 cmd.exe 26->30         started        signatures10 process11 process12 32 conhost.exe 30->32         started        34 logman.exe 30->34         started        36 timeout.exe 30->36         started        38 logman.exe 30->38         started       
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3a0b1c1477285cb20064e603d18096b693f05cd699fb024136a561f8215b559f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a0b1c1477285cb20064e603d18096b693f05cd699fb024136a561f8215b559f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-01-15 02:18:07 UTC
File Type:
Text
Extracted files:
5
AV detection:
5 of 23 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hifryfdxfboleade4yb5daeww2j7axgwth5qeqjwuvq7qik3kwpq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware defense_evasion discovery execution persistence spyware
Link:
https://tria.ge/reports/261012-hh8rtaf17t/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Gathers system information
Modifies Internet Explorer settings
Modifies registry class
Modifies registry key
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Hide Artifacts: Ignore Process Interrupts
Launches sc.exe
Discovers running processes
Executes a VBScript file via the Windows Script Host.
Deobfuscate/Decode Files or Information
Enumerates connected drives
Indicator Removal: File Deletion
Network Share Discovery
Power Settings
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT1_WEBC2_Y21K
Create hunting rule
Author:AlienVault Labs
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments