🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6
SHA3-384 hash: 043665de87c4b7f1178a148dfc31b8dd6dd2ad28e7d0043b6936e220d35dd99644c6bb3b811db8382181d8f511557f06
SHA1 hash: 60a32e99a22db45570c6c5a1a60e768435db3dd7
MD5 hash: 433ab669a9cf8aaa53875599cf1b4a5f
humanhash: virginia-zebra-indigo-fillet
File name:3126311780.bat
Download: download sample
File size:562'686 bytes
First seen:2026-11-10 08:16:45 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 12288:8QAWpp+QqarALF2aBbD1HarBpQb/XpZjAk/zQU+K3tXRF6eL:86ENarALXv67wvn/L3Rd
TLSH T138C4AFFC75047DE62ABF536BD99AADD913AA166397C7D4CC40A4BBC30563332EE02805
Magika batch
Reporter ni_fi_701
Tags:bat

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
bat
Verdict:
Malicious activity
Analysis date:
2026-11-10 12:46:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6e131db9-2c5f-4acb-8da1-bdb2fdf8f60d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98979/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af2d329463538821bc38c9a
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6af2d318e182bee2f744f577/reports/61c4d30c-f891-49b5-a8cc-d4a3abd0c55e/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6
Verdict:
Malicious
File Type:
unix shell
Detections:
Trojan.PowerShell.Cobalt.sb Trojan.PowerShell.AmsiBypass.sb PDM:Trojan.Win32.Generic HEUR:Trojan.BAT.Cobalt.gen
Link:
https://opentip.kaspersky.com/c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6/results?tab=lookup
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2002885
Signature
AI detected malicious Powershell script
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Obfuscated command line found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2002885 Sample: 3126311780.bat Startdate: 10/11/2026 Architecture: WINDOWS Score: 100 61 mr-b01.tm-azurefd.net 2->61 63 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->63 69 Malicious sample detected (through community Yara rule) 2->69 71 Yara detected Clipboard Hijacker 2->71 73 Yara detected Powershell decode and execute 2->73 75 7 other signatures 2->75 12 cmd.exe 1 2->12         started        15 svchost.exe 1 1 2->15         started        signatures3 process4 dnsIp5 83 Suspicious powershell command line found 12->83 85 Obfuscated command line found 12->85 87 Uses ping.exe to sleep 12->87 89 2 other signatures 12->89 18 powershell.exe 18 12->18         started        21 net.exe 1 12->21         started        23 conhost.exe 12->23         started        25 5 other processes 12->25 65 127.0.0.1 unknown unknown 15->65 signatures6 process7 signatures8 67 Found suspicious powershell code related to unpacking or dynamic code loading 18->67 27 cmd.exe 1 18->27         started        29 net1.exe 1 21->29         started        process9 process10 31 powershell.exe 27->31         started        34 net.exe 1 27->34         started        36 conhost.exe 27->36         started        38 5 other processes 27->38 file11 59 C:\Users\user\AppData\...\fnqhci3nzmm.bat, DOS 31->59 dropped 40 cmd.exe 1 31->40         started        43 net1.exe 1 34->43         started        process12 signatures13 77 Suspicious powershell command line found 40->77 79 Obfuscated command line found 40->79 81 Uses ping.exe to sleep 40->81 45 powershell.exe 40->45         started        48 powershell.exe 24 40->48         started        51 PING.EXE 40->51         started        process14 file15 91 Writes to foreign memory regions 45->91 93 Modifies the context of a thread in another process (thread injection) 45->93 95 Injects a PE file into a foreign processes 45->95 53 conhost.exe 45->53         started        55 MSBuild.exe 45->55         started        57 C:\Users\Public\727q12866.ps1, ASCII 48->57 dropped signatures16 process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y5tq3t7r7aykxabk6o7gyzjkhkhnchk5btuajg6iqix56zf367la._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/261110-j6s7psea62/
Behaviour
Runs net.exe
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
System Network Configuration Discovery: Internet Connection Discovery
System Service Discovery
Launches sc.exe
Suspicious use of SetThreadContext
Looks up external IP address via web service
Command and Scripting Interpreter: PowerShell
Malware Family:
cobalt
Create hunting rule
Malicious:
True
Tags:
obfuscated bat macro-powershell self-delete wmi-activity
Link:
https://intel.virussign.com/intelligence/file/c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98979/

Comments