🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807
SHA3-384 hash: 3ac84af06b31c79a376e0f460e70a1934ffa28376b7a1f1178934ff7719dedf8ad99b8be5c250c63157474f5f71c5d27
SHA1 hash: 1b4be061f237c5ca614fc2c366e5841a21a62ada
MD5 hash: af6f4a6ada67c30a87d5852d0bb84aae
humanhash: vermont-juliet-gee-steak
File name:Updater.bat
Download: download sample
File size:25'486 bytes
First seen:2025-11-02 15:30:13 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 384:dSpHfXdTwhq3nwfP5zCpiOSzdgA6VguA6VguFolRdBFolRn+73nw0PgYCogJdj87:dSpHfXdTwhCivzd6/QFjNO6
TLSH T182B2A81B1B5A842688D7D2B2CC5BC582EF3451882441044B33DCD1F7A71F1AEEB6BF6A
Magika batch
Reporter jeans
Tags:bat Ransomware Updater


Avatar
jeans
This seems to be the Updater malware.

Intelligence

File Origin
# of uploads :
1
# of downloads :
311
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807.txt
Verdict:
No threats detected
Analysis date:
2025-11-02 15:31:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/56f3ab99-35fd-4a97-8cd0-6a0d3049375e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35019/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6907794b9942f1282ecb7638
Tags:
ransomware dropper
Result
Verdict:
Clean
Maliciousness:
Gathering data
Verdict:
Malicious
Labled as:
Trojan.LShot.Generic
Link:
https://www.hybrid-analysis.com/sample/b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-02T12:47:00Z UTC
Last seen:
2025-11-04T10:09:00Z UTC
Hits:
~10
Detections:
Worm.BAT.Agent.el
Link:
https://opentip.kaspersky.com/b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807/results?tab=lookup
Score:
17%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807
Threat name:
Script-BAT.Trojan.LShot
Create hunting rule
Status:
Malicious
First seen:
2025-11-02 15:31:13 UTC
File Type:
Text (Batch)
AV detection:
6 of 23 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xd4fdrg6kbf7zmaqdivke4wl47mr7lepwuv7dwfx3az4enabpadq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/251102-sx3t8aar4v/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Updater
Create hunting rule
Author:Malman
Description:Detects a malware script with specific characteristics and strings such as Updater

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/35019/

Comments