MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5
SHA3-384 hash:	32443ff413c9c16ac736c6fa2d138a48c7cc90983011f93991d426234442f27ca3b2a8ba00a22226abadcf0f5e99d5d6
SHA1 hash:	d5855f80a202b82e6374a372f30a152b46227909
MD5 hash:	bbcb23acb89e803dd2146e94194ac8db
humanhash:	twenty-purple-comet-uncle
File name:	inv.bat
Download:	download sample
Signature	PureHVNC Alert Create hunting rule
File size:	568'158 bytes
First seen:	2026-03-31 13:17:48 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	12288:HUUUULUUUUoUUUUoUUUUoUUUU+UUUUlUUUU7UUUUyUUUULUUUUoUUUUfUUUUoUUR:HUUUULUUUUoUUUUoUUUUoUUUU+UUUUlY
TLSH	T196C45C3195FB412238D6287E19CF9533B56AFB580E676B70B40115EF079EB063DE6B20
Magika	batch
Reporter	aachum
Tags:	94-103-1-28 bat ClickFix dal-usa-com FakeCaptcha PureHVNC vault88x-secure-efficient2-su

iamaachum

http://dal-usa.com/inv.bat

C2: 94.103.1.28:56001
Other IOCs:
https://vault88x.secure-efficient2.su/img_060515.png
https://vault88x.secure-efficient2.su/MSI_054600.png

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

45

Origin country :

ES

Vendor Threat Intelligence

ACCE

Gathering data

ANY.RUN

Malware family:

n/a

ID:

1

File name:

inv.bat

Verdict:

No threats detected

Analysis date:

2026-03-31 13:19:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0be5f69c-6d08-45c4-8b0a-753859404f9d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Gathering data

CyberFortress Clean

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cbc9916363ca5d27f02f67

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

DNS request

Connection attempt

Using the Windows Management Instrumentation requests

Enabling autorun by creating a file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 conhost evasive obfuscated overlay powershell

Link:

https://www.filescan.io/uploads/69cbc9922346b9da57b36ec6/reports/a8cc52bb-b711-49d5-a1c3-48823330df21/overview

Hybrid Analysis BAT/Agent.BDM

Verdict:

Suspicious

Labled as:

BAT/Agent.BDM

Link:

https://www.hybrid-analysis.com/sample/7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5

InQuest

Result

Gathering data

Joe Sandbox PureCrypter, ResolverRAT

Result

Threat name:

PureCrypter, ResolverRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1891457

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Detected PureCrypter Trojan

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected ResolverRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=piwlomxfrzst5pajku4tbbq3ycgxnb24xdjndmgiovssqltu5ksq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260331-qj13csax9j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PureHVNC

bat 7a2cb732e58e653ebc09553930861bc08d76875cb8d2d1b0c87565282e74eaa5

(this sample)

  

Link

https://tria.ge/260331-p94eqsdx4y/behavioral2

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/59901/