🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae7ca54128c242a0156ba3a4074ad1af43a0bccc1e58a6126bf1dfd7084da987. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae7ca54128c242a0156ba3a4074ad1af43a0bccc1e58a6126bf1dfd7084da987
SHA3-384 hash: 2235c49bbe5edc583139975273923ae683a776ad5f8b0cc6acc9c2352413c0106701dd880de04b33f1f3780dfb909345
SHA1 hash: 752da159a085fed88eaf371322f898f28867e200
MD5 hash: 6d5b39076b43d1ee6b436308cf8cba91
humanhash: emma-florida-idaho-wolfram
File name:stage1.cmd
Download: download sample
File size:705 bytes
First seen:2026-11-08 10:50:04 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/x-msdos-batch
ssdeep 12:UtKCtLHveNkgzDH79aZgkNFoFMAEcX5uhD1KQVj0K16aidlbDODyrl/79an55All:G3tLPZgPxaZgkYrEosZAQVd6aIlbDODq
TLSH T10601CBAB3E043C7ED57557C4169A484123DAC1DB73A8E6CAF0E405E04D3EB6666734C6
Magika batch
Reporter abuse_ch
Tags:cmd

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a8bb0f4c-8166-48d2-92a7-06ef55b55f6b/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1bff51492c978625a5cbc
Tags:
dropper virus sage
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ae7ca54128c242a0156ba3a4074ad1af43a0bccc1e58a6126bf1dfd7084da987
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-27T11:01:00Z UTC
Last seen:
2026-10-30T18:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ae7ca54128c242a0156ba3a4074ad1af43a0bccc1e58a6126bf1dfd7084da987/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2000788
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Sigma detected: Potential WinAPI Calls Via CommandLine
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Unusual module load detection (module proxying)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2000788 Sample: stage1.cmd Startdate: 08/11/2026 Architecture: WINDOWS Score: 100 73 t.me 2->73 75 super-fourteen33.cc 2->75 77 physioga.net 2->77 119 Malicious sample detected (through community Yara rule) 2->119 121 Antivirus detection for URL or domain 2->121 123 Antivirus / Scanner detection for submitted sample 2->123 125 4 other signatures 2->125 10 cmd.exe 8 2->10         started        12 edgeupd.exe 2->12         started        15 edgeupd.exe 2->15         started        signatures3 process4 signatures5 17 edgeupd.exe 2 10->17         started        20 tar.exe 2 10->20         started        23 curl.exe 1 10->23         started        34 5 other processes 10->34 127 Writes to foreign memory regions 12->127 129 Allocates memory in foreign processes 12->129 131 Creates a thread in another existing process (thread injection) 12->131 26 chrome.exe 2 12->26         started        28 msedge.exe 12->28         started        30 msedge.exe 12->30         started        133 Tries to harvest and steal browser information (history, passwords, etc) 15->133 135 Injects a PE file into a foreign processes 15->135 137 Found direct / indirect Syscall (likely to bypass EDR) 15->137 32 chrome.exe 15->32         started        process6 dnsIp7 107 Bypasses PowerShell execution policy 17->107 109 Writes to foreign memory regions 17->109 111 Allocates memory in foreign processes 17->111 117 3 other signatures 17->117 36 chrome.exe 1 17->36         started        38 chrome.exe 1 17->38         started        40 chrome.exe 17->40         started        49 8 other processes 17->49 71 C:\Users\user\AppData\Local\...\edgeupd.exe, PE32+ 20->71 dropped 87 physioga.net 185.199.172.10, 443, 49704, 49707 HOSTERIONRO Romania 23->87 89 127.0.0.1 unknown unknown 23->89 91 t.me 149.154.167.99, 443, 49758 TELEGRAMVG United Kingdom 26->91 93 super-fourteen33.cc 104.21.60.146, 443, 49759 CLOUDFLARENET-CloudflareIncUS Canada 26->93 113 Tries to harvest and steal ftp login credentials 26->113 115 Tries to steal Crypto Currency Wallets 26->115 42 chrome.exe 26->42         started        45 msedge.exe 28->45         started        47 chrome.exe 32->47         started        file8 signatures9 process10 dnsIp11 51 chrome.exe 7 36->51         started        54 chrome.exe 1 38->54         started        56 chrome.exe 40->56         started        95 142.250.65.78 GOOGLE-GoogleLLCUS United States 42->95 97 142.250.72.1, 443, 49747 GOOGLE-GoogleLLCUS United States 42->97 103 7 other IPs or domains 42->103 99 142.250.72.14 GOOGLE-GoogleLLCUS United States 47->99 101 142.251.154.119 GOOGLE-GoogleLLCUS United States 47->101 105 4 other IPs or domains 47->105 58 chrome.exe 49->58         started        60 chrome.exe 49->60         started        62 msedge.exe 49->62         started        64 5 other processes 49->64 process12 dnsIp13 85 192.168.2.12, 138, 443, 49373 unknown unknown 51->85 66 chrome.exe 51->66         started        69 chrome.exe 51->69         started        process14 dnsIp15 79 142.250.65.65, 443, 49733 GOOGLE-GoogleLLCUS United States 66->79 81 android.l.google.com 142.250.68.206, 443, 49750 GOOGLE-GoogleLLCUS United States 66->81 83 5 other IPs or domains 66->83
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae7ca54128c242a0156ba3a4074ad1af43a0bccc1e58a6126bf1dfd7084da987/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-29 02:00:59 UTC
File Type:
Text (Batch)
AV detection:
8 of 22 (36.36%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vz6kkqjiyjbkaflluosaoswrv5b2bpgmdzmkmetl6hp5occnvgdq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/261108-mxbg3sbw4v/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
cURL User-Agent
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Drops file in Windows directory
Adds Run key to start application
Maps connected drives based on registry
Checks computer location settings
Executes dropped EXE
Malware Family:
alien
Create hunting rule
Malicious:
True
Tags:
calls-wmi bat detect-debug-environment
Link:
https://intel.virussign.com/intelligence/file/ae7ca54128c242a0156ba3a4074ad1af43a0bccc1e58a6126bf1dfd7084da987
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ae7ca54128c242a0156ba3a4074ad1af43a0bccc1e58a6126bf1dfd7084da987

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dgaaga
Create hunting rule
Author:Harshit
Description:Detects suspicious PowerShell or registry activity
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

cmd cmd ae7ca54128c242a0156ba3a4074ad1af43a0bccc1e58a6126bf1dfd7084da987

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/4058850/
  
Delivery method
Distributed via web download

Comments