MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82
SHA3-384 hash:	ed2e145ee9ff250b543f8930bd033a9d1459e1bea0fb90c04471254e5771c436f0513ff52b1df0e1a25ee8413314c0f9
SHA1 hash:	056aca943ed8c7908be6d263a11259ca1acd3718
MD5 hash:	2da7ffde2967c79087e696a461a8de06
humanhash:	whiskey-island-may-football
File name:	rBOQSupplyComme.bat
Download:	download sample
File size:	3'808 bytes
First seen:	2026-02-19 16:30:19 UTC
Last seen:	2026-05-20 16:47:14 UTC
File type:	bat
MIME type:	text/plain
ssdeep	48:bLs9FopKEtqjps94FK39eGcPStHxRQoS/V55J8YY1lcfiKqELUbRlxK9E:bLV5ms9D0DPSt1y55J8/QUbR2E
TLSH	T19871D6F17D1F43A1812A9B567E06C88DAE3A3865E081044D469DC46108AEDE3C6AED9E
Magika	powershell
Reporter	FXOLabs
Tags:	bat

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

56

Origin country :

BR

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

rBOQSupplyComme.bat

Verdict:

Malicious activity

Analysis date:

2026-02-19 16:30:53 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a5b1efe8-df82-47d7-bb7c-16cf086b1890

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/53865/

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.IA.Suspicious.85281654.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6996e6758fffa866e3af4cea

Tags:

n/a

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Creating a file in the %AppData% directory

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/69973aa110e80629d4ea4c51/reports/904e9d05-5575-48ad-8589-6760523c692d/overview

Hybrid Analysis BAT/Agent.BDZ1

Verdict:

Suspicious

Labled as:

BAT/Agent.BDZ1

Link:

https://www.hybrid-analysis.com/sample/86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

Detections:

Trojan.PowerShell.Strion.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82/

Neiki Trojan.PowerShell.Strion

Verdict:

Malicious

Threat:

Trojan.PowerShell.Strion

Link:

https://tip.neiki.dev/file/86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82

ReversingLabs TitaniumCloud Win32.Trojan.Znyonm

Threat name:

Win32.Trojan.Znyonm

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-19 11:22:49 UTC

File Type:

Text

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q3e7u6lgawf5ot2fa7vjz57nazakza7epfrmju5mcrmnx2zsfoba._file

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection discovery execution keylogger persistence privilege_escalation stealer

Link:

https://tria.ge/reports/260219-tzy5gsbt3c/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Event Triggered Execution: Installer Packages

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Use of msiexec (install) with remote resource

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VIPKeylogger

Vipkeylogger family

VMRay GuLoader

Malware family:

GuLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/86c9fa796605/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

bat 86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/53865/