Extracted

• • Target
    deepseek_batch_20260724_2b3d5a.bat
  • Size 7KB
  • SHA256 fe9966806eb60fc6a53bad1dc1c3dbe728c2b7da9a4b87c5338af22bcaaf2e0c
  • MD5 b7dec61bb346f8a5a5d037fcaddaafd8
  • SHA1 d6c8cd2450b844b84f73eb7112a624be42896553
  • SHA512 5f127f85508f17931ce115750074a21f665b90c79654ca5fbeae5a9f29be613af44249a70fba0a67f45ce46ad306b9d15b9c472b0b74fc0308d603c3d463cce0
  • SSDEEP 192:G6+dhFpaCltuND7OcK7aNhygy4fy392mmaIjuSoehjCq:GVFpaCltuNXKaNQfkS92mmafedCq
  • TLSH
    T1B4E1CDEE326040354CFEB2B0AC9D5240353647CB060BAC6CB9AB7D7A1244BF576ED399
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2