MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4a2b35955b5c741f1707abd41f33ff72c3e2aea13bb78c5f563fffe554ad7cfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 4a2b35955b5c741f1707abd41f33ff72c3e2aea13bb78c5f563fffe554ad7cfe |
|---|---|
| SHA3-384 hash: | b75a3e9794c4215d066c64ff7ce95dc04abd60bd746dda1e4b7c9c9ec055f0d783bbc42a292932ddbe3cf21e2f1e730d |
| SHA1 hash: | eff507f4c65349738a379120fc63a8cab28a81d2 |
| MD5 hash: | 9d537a79211fa000f9ed7500bd5b08ce |
| humanhash: | pasta-solar-kilo-arizona |
| File name: | PO_232269.bat |
| Download: | download sample |
| File size: | 3'801 bytes |
| First seen: | 2026-05-20 16:43:11 UTC |
| Last seen: | Never |
| File type: |  bat |
| MIME type: | text/plain |
| ssdeep | 48:bOvpEy8hJcax0rm6B0QZF411pLUHHxapnr3wu35usGSyMC/Nntwp:bOh8JnoeQ7411lUnxaZ3j355Clntwp |
| TLSH | T14871B8F0BE14BB6C19710274EE5E949A87F402FF85E33CA0FA68418A4D2057FF305686 |
| Magika | powershell |
| Reporter |  TomU |
| Tags: | bat |
Intelligence
File Origin
# of uploads :
1
# of downloads :
27
Origin country :
CHVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
PO_232269.bat
Verdict:
No threats detected
Analysis date:
2026-02-10 15:26:26 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
99.1%
Tags:
xtreme shell sage
Result
Verdict:
Clean
Maliciousness:
Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Connection attempt
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
base64 encrypted obfuscated powershell
Verdict:
Malicious
File Type:
ps1
First seen:
2026-02-10T07:40:00Z UTC
Last seen:
2026-05-22T11:53:00Z UTC
Hits:
~10000
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Threat name:
Script-PowerShell.Trojan.GuLoader
Status:
Malicious
First seen:
2026-02-10 11:10:00 UTC
File Type:
Text (JavaScript)
AV detection:
13 of 36 (36.11%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
bat 4a2b35955b5c741f1707abd41f33ff72c3e2aea13bb78c5f563fffe554ad7cfe
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.