MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ecfa03a3ff03c4b5ea9c961d0f00ad3e3c2e8a2f7ca151dafb107c69756acba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Koadic

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	4ecfa03a3ff03c4b5ea9c961d0f00ad3e3c2e8a2f7ca151dafb107c69756acba
SHA3-384 hash:	cc0e3d7636f77412db5d63ad028359bb1de7695e4be26814f16dcfc7cfd1fbec964e9692fe1ecf97af68fc2e45a352f0
SHA1 hash:	d81e77d8681d0199526468d8a968d0248f88407d
MD5 hash:	27951233b5160a746c090b5920678bc7
humanhash:	oklahoma-oranges-hot-arizona
File name:	BBRXt.bat
Download:	download sample
Signature	Koadic Create hunting rule
File size:	13'805 bytes
First seen:	2025-10-30 15:10:27 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	384:oQGp3gaMBroCQzPKxWcTiX0GXQXi3CINXny:xGp3gaMBroCQzPKxWcTiXdXQXi3CINXy
TLSH	T162520A308EB50E8EE8F5832BE6BB5821FEADD4BD4060E74A90177DAD07D9755A71B030
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	Anonymous
Tags:	bat Koadic

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

_4ecfa03a3ff03c4b5ea9c961d0f00ad3e3c2e8a2f7ca151dafb107c69756acba.txt

Verdict:

No threats detected

Analysis date:

2025-10-30 15:11:55 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5e4ed89c-62b8-4ce9-ab43-1ead080dd5a2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

KoadicBAT

Link:

https://www.capesandbox.com/analysis/34818/

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69038010706befaf4eca6996

Tags:

obfuscated shell sage

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Launching a process

Running batch commands

Creating a process with a hidden window

Creating a file

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4ecfa03a3ff03c4b5ea9c961d0f00ad3e3c2e8a2f7ca151dafb107c69756acba

Verdict:

Malicious

File Type:

text

First seen:

2025-08-28T17:22:00Z UTC

Last seen:

2025-11-01T02:41:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.BAT.Generic

Link:

https://opentip.kaspersky.com/4ecfa03a3ff03c4b5ea9c961d0f00ad3e3c2e8a2f7ca151dafb107c69756acba/results?tab=lookup

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ecfa03a3ff03c4b5ea9c961d0f00ad3e3c2e8a2f7ca151dafb107c69756acba/

Verdict:

Malicious

Threat:

Trojan.BAT

Link:

https://tip.neiki.dev/file/4ecfa03a3ff03c4b5ea9c961d0f00ad3e3c2e8a2f7ca151dafb107c69756acba

Threat name:

Script-BAT.Packed.Generic

Status:

Suspicious

First seen:

2025-10-11 15:38:09 UTC

File Type:

Text

AV detection:

4 of 38 (10.53%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j3h2aor76a6ewxvjzfq5b4ak2pr4f2fc67fbkhnpwed4nf2wvs5a._file

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion execution

Link:

https://tria.ge/reports/251030-skjktazqek/

Behaviour

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4ecfa03a3ff03c4b5ea9c961d0f00ad3e3c2e8a2f7ca151dafb107c69756acba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.