MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 446ea0cb787ab031caf13468a84b27ec97be91c071234858e17b5dfe38e2b673. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	446ea0cb787ab031caf13468a84b27ec97be91c071234858e17b5dfe38e2b673
SHA3-384 hash:	7035d9ed8d8fce69472c199105c5c9f4184d399fa05592f96226359d667ef8acbae64b81b856af4bb51a6592fa767a6b
SHA1 hash:	19455883c9735cbac735c3501942f0c08f0345ea
MD5 hash:	fe54c5d297a5a1422e89a7463a75666b
humanhash:	seven-freddie-edward-chicken
File name:	31260547.bat
Download:	download sample
File size:	561'170 bytes
First seen:	2026-11-12 07:51:23 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	12288:kaaz62Nz6iRSEm57I1MI96C4NSj1qPNfPKYF8E4BzHQvGF6ic1m17LixkV:kj62Nz4EC7I2Ih4s8FHKYusv/icg1SyV
TLSH	T1F5C4AFF875046DD666BF526BD996ACDC13BA16629BCBE4CC40A4BFC30563372EE02C05
Magika	batch
Reporter	ni_fi_701
Tags:	bat

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

69

Origin country :

AT

Vendor Threat Intelligence

ACCE BatchScript_FileType

Malware configuration found for:

BatchScript

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c7b4ef25-bd6c-4b5d-b25c-ceb29666a29f/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

bat

Verdict:

Malicious activity

Analysis date:

2026-11-12 07:54:16 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ebe78746-a6b4-4bbf-ab2b-733bbfb38c93

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99566/

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af5702fc48f25399eb55079

Tags:

obfuscate shell java sage

Hybrid Analysis BAT/Agent.BWF

Verdict:

Suspicious

Labled as:

BAT/Agent.BWF

Link:

https://www.hybrid-analysis.com/sample/446ea0cb787ab031caf13468a84b27ec97be91c071234858e17b5dfe38e2b673

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

Detections:

Trojan.PowerShell.AmsiBypass.sb HEUR:Trojan.BAT.Cobalt.gen Trojan.PowerShell.Cobalt.sb

Link:

https://opentip.kaspersky.com/446ea0cb787ab031caf13468a84b27ec97be91c071234858e17b5dfe38e2b673/results?tab=lookup

Joe Sandbox Clipboard Hijacker

Result

Threat name:

Clipboard Hijacker

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2004504

Signature

AI detected malicious Powershell script

Bypasses PowerShell execution policy

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Obfuscated command line found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to detect sandboxes / dynamic malware analysis system (Installed program check)

Uses dynamic DNS services

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes to foreign memory regions

Yara detected Clipboard Hijacker

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

81%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/446ea0cb787ab031caf13468a84b27ec97be91c071234858e17b5dfe38e2b673

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/446ea0cb787ab031caf13468a84b27ec97be91c071234858e17b5dfe38e2b673/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=irxkbs3ypkyddsxrgrukqszh5sl35eoaoeruqwhbpno74ohcwzzq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261112-jqgtqssy3r/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Executes a command shell one-liner

System Network Configuration Discovery: Internet Connection Discovery

System Service Discovery

Launches sc.exe

Suspicious use of SetThreadContext

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

VirusSign cobalt

Malware Family:

cobalt

Alert

Create hunting rule

Malicious:

True

Tags:

self-delete wmi-activity macro-ps bat obfuscated

Link:

https://intel.virussign.com/intelligence/file/446ea0cb787ab031caf13468a84b27ec97be91c071234858e17b5dfe38e2b673

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/446ea0cb787ab031caf13468a84b27ec97be91c071234858e17b5dfe38e2b673

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/99566/