🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3af38aef0f862bc9152c7f0f3e0837c10d8a952cc03cd387ff081e00e0db0989. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3af38aef0f862bc9152c7f0f3e0837c10d8a952cc03cd387ff081e00e0db0989
SHA3-384 hash: e1d6a2ac0e0ff9e4a430c715350c8a2721fa659966a83add6a8aca16dee39eeb5d0e09a05f7de919e888c7106b7d33d1
SHA1 hash: 327a9f13cd974652c3608fac0079a80f33b98f39
MD5 hash: 81106b125307569f3c1cb6e755a5b426
humanhash: sink-michigan-music-gee
File name:d2.bat
Download: download sample
File size:235 bytes
First seen:2026-11-14 06:52:01 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 6:hi8GFrxF3QtusHtr8GFz6AxWb4RwdmaEF1QmXbS:E8GsNr8jvbcwdye4S
TLSH T113D0A750F752086EDBB1883071EE89436592A48934742172F7D35449ADE0617E234B9D
Magika batch
Reporter Latin

Intelligence

File Origin
# of uploads :
1
# of downloads :
13
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/38b85624-5c2b-41e2-bbd6-2ce3326fa1f0/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99948/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af805230a71acf937da83b9
Tags:
shell agent sage
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3af38aef0f862bc9152c7f0f3e0837c10d8a952cc03cd387ff081e00e0db0989
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/2005851
Signature
Joe Sandbox ML detected suspicious sample
Powershell connects to network
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious Script Execution From Temp Folder
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2005851 Sample: d2.bat Startdate: 14/11/2026 Architecture: WINDOWS Score: 56 18 Joe Sandbox ML detected suspicious sample 2->18 20 Sigma detected: Suspicious Invoke-WebRequest Execution 2->20 22 Sigma detected: Suspicious Script Execution From Temp Folder 2->22 6 cmd.exe 2 2->6         started        process3 process4 8 powershell.exe 14 15 6->8         started        12 powershell.exe 7 6->12         started        14 conhost.exe 6->14         started        dnsIp5 16 45.117.179.48, 19092, 49713 NHANHOA-AS-VNNhanHoaSoftwarecompanyVN Vietnam 8->16 24 Powershell connects to network 8->24 signatures6
Score:
50%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/3af38aef0f862bc9152c7f0f3e0837c10d8a952cc03cd387ff081e00e0db0989
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3af38aef0f862bc9152c7f0f3e0837c10d8a952cc03cd387ff081e00e0db0989/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hlzyv3ypqyv4sfjmp4ht4cbxyegyvfjmya6nhb77bapabyg3bgeq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/261114-hm96fawy4p/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99948/

Comments