MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1959d13ed5ed2b9bda23a49db541a3a44b87471c31a8e7a99cc92fc80a7286d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	e1959d13ed5ed2b9bda23a49db541a3a44b87471c31a8e7a99cc92fc80a7286d
SHA3-384 hash:	6818e8373a763e8870ff3a8e523acb525f1775d61a7ce3d6f9d9792518978d6aa3947942876e0f58072ac78cc4a2aebf
SHA1 hash:	2d698d2dcf63fc21af663671911aa14acad82125
MD5 hash:	e8d2a73975d83bf366b87be5ee863445
humanhash:	carpet-seventeen-steak-happy
File name:	Q3of4LgtPX.bat
Download:	download sample
File size:	197 bytes
First seen:	2026-05-16 14:49:19 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	6:hITg3Nou11r+DE1WD54HEyKOZG1Bn23fm:OTg9YDEo4kp2u
TLSH	T127D0C0239C02CB2B0443080348F9028C90E32C4C75C87F2007D50C6C264B47AF2DBAC1
Magika	batch
Reporter	BastianHein
Tags:	bat

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

bat

Verdict:

No threats detected

Analysis date:

2026-05-16 14:51:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e436f9f5-d951-4ad4-9dce-7af70491b048

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/66125/

Detection(s):

SecuriteInfo.com.PUA.IA.Suspicious.27631255.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0883f946d6967b3d90af00

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a0883f6efbd399b39b2fdf4/reports/f9f84f6a-04b0-460b-a753-59787d780b1d/overview

Verdict:

Malicious

Labled as:

Trojan/BAT.Runner

Link:

https://www.hybrid-analysis.com/sample/e1959d13ed5ed2b9bda23a49db541a3a44b87471c31a8e7a99cc92fc80a7286d

Verdict:

Clean

File Type:

unix shell

Link:

https://opentip.kaspersky.com/e1959d13ed5ed2b9bda23a49db541a3a44b87471c31a8e7a99cc92fc80a7286d/results?tab=lookup

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/e1959d13ed5ed2b9bda23a49db541a3a44b87471c31a8e7a99cc92fc80a7286d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e1959d13ed5ed2b9bda23a49db541a3a44b87471c31a8e7a99cc92fc80a7286d/

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/e1959d13ed5ed2b9bda23a49db541a3a44b87471c31a8e7a99cc92fc80a7286d

Threat name:

Script-BAT.Trojan.Runner

Status:

Malicious

First seen:

2026-05-16 14:51:07 UTC

File Type:

Text (Batch)

AV detection:

7 of 24 (29.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4gkz2e7nl3jltpnchje5wva2hjclq5drymni46uzzsjpzafhfbwq._file

Gathering data

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/e1959d13ed5ed2b9bda23a49db541a3a44b87471c31a8e7a99cc92fc80a7286d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DelBat1 Create hunting rule
Author:	Madhav
Description:	This is a bat file which deletes the malicious file after the malicious files are executed

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.