MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9926933a12076a75672d0f7053cdb83dca09ab42d9bb0d7b73d3562f7d62381d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9926933a12076a75672d0f7053cdb83dca09ab42d9bb0d7b73d3562f7d62381d
SHA3-384 hash:	cde459feca73e377c7855048c0032a8f2b7623ae328b8fbaa54a31a138d587dd04696a6dc016aebe20411cb545a938b6
SHA1 hash:	5a5091f2ed47a306dd68f8c332ff82efd18ed6a2
MD5 hash:	2ccc4345ec927a6117a3e07caa5809af
humanhash:	burger-cup-emma-twenty
File name:	2ccc4345ec927a6117a3e07caa5809af.bat
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	375 bytes
First seen:	2024-12-04 13:19:44 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	6:hSG81R3KuX85AwgJrsHmr5Syl75EuH1MFCv8STFx755yjSAwgJrsHmrryyl7KXYa:0G81kTQJrDr5SylFt1M40WFxF52JrDr6
TLSH	T15DE0266312BA6307EA308078F5F21F43F20BB383C487BB961616BA9C559D04F7AE8502
Magika	txt
Reporter	abuse_ch
Tags:	bat Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

2ccc4345ec927a6117a3e07caa5809af.bat

Verdict:

Malicious activity

Analysis date:

2024-12-04 13:23:51 UTC

Tags:

loader

Link:

https://app.any.run/tasks/351c20e3-b4c1-4714-b582-317a502ed0cb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6750581bbc8c6beb30759df7

Tags:

gumen virus shell overt

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

Connection attempt

Searching for the window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

dropper kiosk powershell

Link:

https://www.filescan.io/uploads/6750570ce5f1046769296f3f/reports/8a862fd3-1675-42fe-8005-82be5b6f9dcc/overview

Hybrid Analysis BZC.PZQ.Boxter.928

Verdict:

Malicious

Labled as:

BZC.PZQ.Boxter.928

Link:

https://www.hybrid-analysis.com/sample/9926933a12076a75672d0f7053cdb83dca09ab42d9bb0d7b73d3562f7d62381d

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1568272

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Connects to many ports of the same IP (likely port scanning)

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/9926933a12076a75672d0f7053cdb83dca09ab42d9bb0d7b73d3562f7d62381d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9926933a12076a75672d0f7053cdb83dca09ab42d9bb0d7b73d3562f7d62381d/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tetjgoqsa5vhkzznb5yfhtnyhxfatk2c3g5q263t2nlc67lchaoq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/241204-qk3ycawpcx/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9926933a12076a75672d0f7053cdb83dca09ab42d9bb0d7b73d3562f7d62381d