MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1c9a4c7b6dddebdd82be53e9deff35639e185e3fb3074ce8f891fcb66059086. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	e1c9a4c7b6dddebdd82be53e9deff35639e185e3fb3074ce8f891fcb66059086
SHA3-384 hash:	3df946315ba5143ff5f070148b5cba3b7a60927f1b4402a98992f5f3ecbf80d451e98fb5f9bd95476354a190b78c0b12
SHA1 hash:	9bfc03f7e982a6863ae436a2703c1ea18368fb18
MD5 hash:	5eaf0ab4b310bc9b81a31c7b3dd6b114
humanhash:	fifteen-zulu-south-oregon
File name:	infected-tsundereRAT.bat
Download:	download sample
File size:	2'730'183 bytes
First seen:	2026-10-18 16:57:30 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	49152:x0llwhSBi4LpCi/XJyuXEmFQQCwBkU/90B+8ekVOA:r
TLSH	T1F1C51315862D873F86FC107428FE1E566F644F800178EEE985B4B8DB678FE8111FA798
Magika	batch
Reporter	Anonymous
Tags:	.live amsi bat batch malicious RAT Tsundere Tsundererat

Anonymous

this is a seamingly new malware as a server (MAAS) called Tsundere / Tsundere RAT. it appears its not related to TSUNDERE BOTNET but to be its own tool?

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

BatchScript

Details

Link:

https://research.acce.ciphertechsolutions.com/results/fac3cefc-0fec-4282-803a-0768908466c9/

Malware family:

n/a

ID:

File name:

infected-tsundereRAT.bat

Verdict:

Malicious activity

Analysis date:

2026-10-18 17:06:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cffca560-027b-485b-a1f2-92656eb67f8f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92531/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad5ca9dafb06e650cd7d3b3

Tags:

shell sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Creating synchronization primitives

Connection attempt

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-18T14:16:00Z UTC

Last seen:

2026-10-19T19:03:00Z UTC

Hits:

~10

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.BAT.Alien.gen HackTool.MSIL.AmsiBypassHwBp.sb Trojan.MSIL.Quasar.a

Link:

https://opentip.kaspersky.com/e1c9a4c7b6dddebdd82be53e9deff35639e185e3fb3074ce8f891fcb66059086/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e1c9a4c7b6dddebdd82be53e9deff35639e185e3fb3074ce8f891fcb66059086

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4he2jr5w3xpl3wbl4u7j337tky46dbpd7myhjtuprep4wzqfscda._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

bat e1c9a4c7b6dddebdd82be53e9deff35639e185e3fb3074ce8f891fcb66059086

(this sample)

Link

https://tsundere.live/

Dropping

TsundereRAT

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/92531/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample