MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941
SHA3-384 hash:	bcecea0c59d788ec1526098c57b5eb69a57028624897b1e1fd353d78bb510685581c22ae3cd5297caaf781a8dc5ebbdd
SHA1 hash:	096b3dd958f8ad8617d7b22a349e28c92fe318b6
MD5 hash:	10a0e172b606d94d36c28cdd0978f11e
humanhash:	california-charlie-nevada-mexico
File name:	up.bat
Download:	download sample
Signature	Braodo Alert Create hunting rule
File size:	1'351'204 bytes
First seen:	2026-03-13 10:05:02 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	24576:lgX4VtgX4VtgX4VtgX4VMgX4VtgX4VtgX4VtgX4V0:S4A4A4A4R4A4A4A4q
TLSH	T10E55F125DB6A2FCD2D390E8D046E3D574D9A6D313D22C8B0CADF280F8125BF65662D1B
TrID	45.4% (.MP3) MP3 audio (ID3 v1.x tag) (2500/1/1) 36.3% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 18.1% (.MP3) MP3 audio (1000/1)
Magika	autoit
Reporter	JAMESWT_WT
Tags:	bat Braodo github-com--m1-nc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

74

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

_a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941.txt

Verdict:

Malicious activity

Analysis date:

2026-03-13 10:05:53 UTC

Tags:

github

Link:

https://app.any.run/tasks/3e8cbe61-c722-4435-aea0-7ae24ff30783

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/57287/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.BadBatObs.31934.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69b3e16d9872190419bfe4f3

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

net obfuscated

Link:

https://www.filescan.io/uploads/69b3e16b2000fc76c3d9d593/reports/d16f5377-4115-4286-b81e-b202ec99f7af/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

text

Link:

https://opentip.kaspersky.com/a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-03-08 18:14:16 UTC

File Type:

Text (Batch)

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vead3yaktmk64xnd6r74wppzl6nm5nrbu2x57d2yqomemhtlxfaq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260313-l4rbfae161/

Behaviour

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Contacts third-party web service commonly abused for C2

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Braodo

bat a9003de00a9b15ee5da3f47fcb3df95f9aceb621a6afdf8f588398461e6bb941

(this sample)

Cape

https://www.capesandbox.com/analysis/57287/

  

URLhaus

https://urlhaus.abuse.ch/url/3795149/

  

Delivery method

Distributed via web download