MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1536dbe6ea391024c63dedb2a49013b5700f10887ca10aaf15e7f7bf402ee9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c1536dbe6ea391024c63dedb2a49013b5700f10887ca10aaf15e7f7bf402ee9c
SHA3-384 hash:	421e5a9615549c2c4fb78335acdbfaaee7e87c099cd8502e2b51d1e55d2717d2df1dbd8011b9c794bbff0466bf49a2da
SHA1 hash:	8c930daf93dd8003c2608325d600a52958b00e90
MD5 hash:	01738ebe8f1149eb226f6f370b41adc9
humanhash:	carbon-kitten-happy-dakota
File name:	swt
Download:	download sample
File size:	492 bytes
First seen:	2026-05-03 18:39:50 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	6:hzLYVJhZiqiVfa2VDOvqVbADqiVfa2VDOvq4A7aHfBQNVomxRKVHAbKo0tVk30Si:5YVJhZ54b7l4bWX0aVHAbr4OVlCk6Pp
TLSH	T177F05CDC94613AB11BCDC9133A91728AF00950E14F62AC696BC121DA5EC61D92FEBBD2
Magika	batch
Reporter	BlinkzSec
Tags:	bat

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

28

Origin country :

US

Vendor Threat Intelligence

ACCE BatchScript_FileType

Malware configuration found for:

BatchScript

Details

BatchScript

varying reportable information from embedded commands and any observed URLs

Link:

https://research.acce.ciphertechsolutions.com/results/e3f3a6af-fb0f-47ce-bb16-c51c90aec1fd/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

windows.bat

Verdict:

Malicious activity

Analysis date:

2026-05-04 00:23:02 UTC

Tags:

loader

Link:

https://app.any.run/tasks/8e5970d0-6be5-431f-8972-181b3b15ddd4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.43427681.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Running batch commands

Launching a process

Creating a window

Connecting to a non-recommended domain

Connection attempt

Sending an HTTP GET request

Creating a file

Creating a process from a recently created file

Sending a custom TCP request

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

certutil cmd findstr lolbin wmic

Link:

https://www.filescan.io/uploads/69f83a7686e92bda701d3ada/reports/d4324ee7-c2ad-4ed9-ad29-04aa4cb35bcf/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-05-03T15:52:00Z UTC

Last seen:

2026-05-05T02:00:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Stealer.TCP.C&C Trojan-Downloader.Agent.HTTP.C&C HEUR:Trojan.BAT.Alien.gen Backdoor.VShell.TCP.C&C Backdoor.VShell.HTTP.C&C Trojan.Win32.Shelm.c Trojan.VBS.Runner.sb HEUR:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/c1536dbe6ea391024c63dedb2a49013b5700f10887ca10aaf15e7f7bf402ee9c/results?tab=lookup

Nucleon Malprob Benign

Score:

25%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c1536dbe6ea391024c63dedb2a49013b5700f10887ca10aaf15e7f7bf402ee9c

CERT.PL MWDB

Gathering data

Neiki Backdoor.VShell.TCP

Verdict:

Malicious

Threat:

Backdoor.VShell.TCP

Link:

https://tip.neiki.dev/file/c1536dbe6ea391024c63dedb2a49013b5700f10887ca10aaf15e7f7bf402ee9c

ReversingLabs TitaniumCloud Script-BAT.Trojan.Boxter

Threat name:

Script-BAT.Trojan.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-03 18:25:09 UTC

File Type:

Text (Batch)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yfjw3ptouoiqetdd33nsusibhnlqb4iiq7fbbkxrlz7xx5ac52oa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.