MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a367a461a57c1dd3f2ce3a975ea950d37023870cc9083a54d471ff3cc266b43b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | a367a461a57c1dd3f2ce3a975ea950d37023870cc9083a54d471ff3cc266b43b |
|---|---|
| SHA3-384 hash: | c25d562727d2dfe093b92dc8647137577813f6d4db464c864e764850fa1a1264ea1dd2b77e61517d4494290e2b8158a6 |
| SHA1 hash: | f30ab635e29a13bc6f872a8298fda828e8a94bb4 |
| MD5 hash: | 811e69d5075ffe5ab50de2ba02fde698 |
| humanhash: | black-uncle-lemon-fourteen |
| File name: | load.bat |
| Download: | download sample |
| File size: | 798 bytes |
| First seen: | 2026-08-19 19:13:06 UTC |
| Last seen: | Never |
| File type: |  bat |
| MIME type: | text/x-msdos-batch |
| ssdeep | 24:3LD8Y+M4dzxkj9mS1ATxTS1AhxlS1AlxmAS1AHxm1azAV8APAj8AJ:3LDXwEmSiSCS+SFY |
| TLSH | T1E501D6D7001EE47FDF23CB25D70986C6F12BDA7088EE334A6272585B7801A0533D96CA |
| Magika | batch |
| Reporter |  juroots |
| Tags: | bat |
Intelligence
File Origin
# of uploads :
1
# of downloads :
54
Origin country :
CHVendor Threat Intelligence
No detections
Malware family:
phorpiex
ID:
1
File name:
2to1ep.exe
Verdict:
Malicious activity
Analysis date:
2026-08-15 14:57:29 UTC
Tags:
auto metasploit framework evasion phorpiex botnet python solaris loader stealer stealc screenconnect remote github phishing xmrig miner obfuscated-vbs generic powershell ipfs arcticagent rat nemucod massbass pikabot maskgram telegram remcos clickfix rmm-tool rdp possible-phishing njrat asyncrat maskgramstealer sliver glamour xworm rustystealer datto bladabindi vidar acr ip-check tinynuke action1rmm remusstealer adware redosdru autoit tool purelogs zigcryptostealer pastebin sheet pyinstaller cobaltstrike cryptolocker ransomware gh0st networm amus bruteratel cryptowall salatstealer phantom wannacry websocket smoke winring0-sys vuln-driver putty meterpreter coinminer donutloader quasar action1 amadey reversessh ammy lumma ftp delphi netsupport clipper diamotrix santastealer dcrat darkcrystal sheetrat autohotkey openssl jeefo smb azorult grandoreiro banker scan smbscan etherhiding jigsaw backdoor noescape wiper whitesnake qatarrat guloader koiloader havoc rhadamanthys teamviewer stealerium redline remus emotet gofile whitesnakestealer arch-scr
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching a process
Running batch commands
Creating a process with a hidden window
Connection attempt
Sending an HTTP GET request
Creating a file in the system32 directory
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Creating a file
Sending a custom TCP request
Сreating synchronization primitives
DNS request
Using the Windows Management Instrumentation requests
Windows shutdown
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug anti-vm base64 cmd crypto evasive fingerprint keylogger lolbin powershell reconnaissance wscript
Verdict:
Malicious
Labled as:
CMD:BZC.PZQ.Pantera.218
Score:
89%
Verdict:
Malware
File Type:
SCRIPT
Threat name:
Script-BAT.Trojan.Pantera
Status:
Malicious
First seen:
2026-08-16 01:22:16 UTC
AV detection:
6 of 38 (15.79%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
ADMINTOOL_AutoHotkey
Result
Malware family:
n/a
Score:
8/10
Tags:
execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
cURL User-Agent
Executes a command shell one-liner
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
bat a367a461a57c1dd3f2ce3a975ea950d37023870cc9083a54d471ff3cc266b43b
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.