🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb14c05efa0cecbbda853d4a063aca4161e96bbaf6e763eb4bc2a3db315c7bc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb14c05efa0cecbbda853d4a063aca4161e96bbaf6e763eb4bc2a3db315c7bc7
SHA3-384 hash: d4bf900620d800e3c644e5621719e2e3c9eeffaf69fb06b6e97cd0d7a1579de3e16d6cf50bfd9963ae98d0190c880ae8
SHA1 hash: ac948fa29e4b43510ddf85c24494117c2a32d335
MD5 hash: 2f8883f0e9e24b87a1bded87e27bd775
humanhash: timing-november-saturn-cardinal
File name:death.txt
Download: download sample
File size:6'149 bytes
First seen:2026-03-19 07:57:10 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 192:QbWYlZf+6zA9pCedqmzke5QIdlIflzflGflUfl5fQZ226CUvWtXSCiWPv8f7bSfC:Q6YvflzA9pCedqmzkoQIdyfxfwfSfLfz
TLSH T194C109563DDA5E2449821CE1D6F76715AA85D3CFEC913EC072E06209FD0BE392B219DC
Magika batch
Reporter Skynet11
Tags:bat

Intelligence

File Origin
# of uploads :
1
# of downloads :
32
Origin country :
AU AU
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/73a08ad7-d0df-4746-b5c9-1415c0414edf/
Malware family:
n/a
ID:
1
File name:
death.txt
Verdict:
Malicious activity
Analysis date:
2026-03-18 23:13:24 UTC
Tags:
uac stealer anti-evasion
Link:
https://app.any.run/tasks/ad5c43e0-164e-44cc-97d8-fb7733bb050d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.BAT.Delwin-4.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69bbf4d988c80c01586c0370
Tags:
dropper shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Creating a window
Running batch commands
Sending a custom TCP request
Adding an access-denied ACE
Reading critical registry keys
Enabling autorun with the shell\open\command registry branches
Gathering data
Verdict:
Malicious
Labled as:
UAC.Marte.B.Generic
Link:
https://www.hybrid-analysis.com/sample/cb14c05efa0cecbbda853d4a063aca4161e96bbaf6e763eb4bc2a3db315c7bc7
Verdict:
Malicious
File Type:
unix shell
Detections:
Trojan-Ransom.Win32.Encoder.sb Trojan.Win32.Agent.sb HEUR:Trojan.BAT.KillWin.gen
Link:
https://opentip.kaspersky.com/cb14c05efa0cecbbda853d4a063aca4161e96bbaf6e763eb4bc2a3db315c7bc7/results?tab=lookup
Score:
5%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/cb14c05efa0cecbbda853d4a063aca4161e96bbaf6e763eb4bc2a3db315c7bc7
Gathering data
Verdict:
Malicious
Threat:
Trojan-Ransom.Win32.Encoder
Link:
https://tip.neiki.dev/file/cb14c05efa0cecbbda853d4a063aca4161e96bbaf6e763eb4bc2a3db315c7bc7
Threat name:
Text.Trojan.Marte
Create hunting rule
Status:
Malicious
First seen:
2026-03-19 13:06:33 UTC
File Type:
Text (Batch)
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zmkmaxx2btwlxwufhvfamowkifq6s25263twh22lykr5wmk4ppdq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware defense_evasion discovery execution exploit persistence privilege_escalation spyware
Link:
https://tria.ge/reports/260319-qcc2ysgz3y/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies registry key
Suspicious use of WriteProcessMemory
Browser Information Discovery
Hide Artifacts: Ignore Process Interrupts
Launches sc.exe
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Indicator Removal: File Deletion
Modifies boot configuration data using bcdedit
Disables service(s)
Event Triggered Execution: Component Object Model Hijacking
Modifies file permissions
Modifies system executable filetype association
Stops running service(s)
Boot or Logon Autostart Execution: Active Setup
Manipulates Digital Signatures
Possible privilege escalation attempt
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cb14c05efa0cecbbda853d4a063aca4161e96bbaf6e763eb4bc2a3db315c7bc7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments