MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c3703f10cc51891b777b78f080d831e2bd4977eda91e64ea4a2edb0284a6b0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c3703f10cc51891b777b78f080d831e2bd4977eda91e64ea4a2edb0284a6b0d
SHA3-384 hash: d4e0dee51a927e2879cee77d3dbda33d0540070df692ed4cd9ec115a168fe0d0749807bd32ede37fca58566e14163255
SHA1 hash: a9a4e14ae1a900a200523af4bad2121664b03b8c
MD5 hash: 8e7a14c41b4dff8a54309c4f63da62f0
humanhash: tango-hydrogen-william-hotel
File name:ud.bat
Download: download sample
File size:943'855 bytes
First seen:2025-03-17 19:37:03 UTC
Last seen:2025-03-17 19:41:24 UTC
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 1536:xJJJJJJJJJJJJbJKJJJJJJJJJJJJJJJJJJJvJJJJJJJJJJJJgJJJzJJJJJJJJJJz:D
TLSH T1BD150950DA7B7AC1EE83B65025B77460F2CC5C077E39E8F63CFA3646C060C1AD969926
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika unknown
Reporter JAMESWT_WT
Tags:bat ty9989

Intelligence

File Origin
# of uploads :
2
# of downloads :
125
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d889c63962f1a6f4726a70
Tags:
rapid shell spawn sage
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Searching for the window
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5c3703f10cc51891b777b78f080d831e2bd4977eda91e64ea4a2edb0284a6b0d
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
24 / 100
Link:
https://www.joesandbox.com/analysis/1640886
Signature
Suspicious powershell command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 1640886 Sample: ud.bat Startdate: 17/03/2025 Architecture: WINDOWS Score: 24 6 cmd.exe 1 2->6         started        9 svchost.exe 1 1 2->9         started        dnsIp3 20 Suspicious powershell command line found 6->20 12 powershell.exe 11 6->12         started        14 conhost.exe 6->14         started        18 127.0.0.1 unknown unknown 9->18 signatures4 process5 process6 16 conhost.exe 12->16         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c3703f10cc51891b777b78f080d831e2bd4977eda91e64ea4a2edb0284a6b0d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lq3qh4imyumjdn3xw6hqqdmddyv5jf363ki6mtveulw3akcknmgq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/250317-ybvjlsw1gy/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c3703f10cc51891b777b78f080d831e2bd4977eda91e64ea4a2edb0284a6b0d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments