MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 49a2f1d116da65457939ac73e11c1c70c2ff8254ebd106862c2fd9e5fc2b7dd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 49a2f1d116da65457939ac73e11c1c70c2ff8254ebd106862c2fd9e5fc2b7dd5 |
|---|---|
| SHA3-384 hash: | 80b01a7b67f2bed0291c7d989f929c3ab7fed00f8877e1bd04be0e9318a89ab5617161ce764c378176a60e6fc06165a7 |
| SHA1 hash: | 92f0eda2c51815fe40785d3db8dfec06c7e6c70e |
| MD5 hash: | 4ddf97822a4ccf29d56b81dd38e11d23 |
| humanhash: | coffee-autumn-fruit-equal |
| File name: | download_dll.cmd |
| Download: | download sample |
| File size: | 479 bytes |
| First seen: | 2025-09-08 18:41:10 UTC |
| Last seen: | Never |
| File type: |  cmd |
| MIME type: | text/x-msdos-batch |
| ssdeep | 12:waDKgWWrDlTNXZGiX/XZYlby22NSKhxNTjVLoXCoKT:waDHZPlTpc0PGp8lhzXQte |
| TLSH | T101F02765401A526601F123B18AF4E14FC34ACF9A0B1590CC3B5C1264FFAE4234AA13E4 |
| Magika | batch |
| Reporter |  smica83 |
| Tags: | cmd |
Intelligence
File Origin
# of uploads :
1
# of downloads :
40
Origin country :
HUVendor Threat Intelligence
Verdict:
Malicious
Score:
90.2%
Tags:
shell spawn sage
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
anti-debug certutil fingerprint keylogger lolbin overlay packed
Verdict:
Suspicious
Labled as:
BAT/TrojanDownloader.Agent
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-08T16:04:00Z UTC
Last seen:
2025-09-08T16:04:00Z UTC
Hits:
~10
Detections:
Trojan.VBS.Runner.sb PDM:Trojan.Win32.Generic HEUR:Trojan.BAT.Alien.gen
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
56 / 100
Signature
Sigma detected: Connection Initiated Via Certutil.EXE
Sigma detected: Legitimate Application Dropped Executable
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Score:
66%
Verdict:
Susipicious
File Type:
SCRIPT
Verdict:
Malicious
Threat:
Trojan.VBS.Runner
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Downloads MZ/PE file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
cmd 49a2f1d116da65457939ac73e11c1c70c2ff8254ebd106862c2fd9e5fc2b7dd5
(this sample)
exe
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.