c8bdf05f16bc34c8b5abf1f6d5feff99b7e9156cbfc4a0c55188fd60ff62cc83

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gemini-code-1786563359509.bat
Size 1KB
Sample260812-ybbrhatekd
SHA256 c8bdf05f16bc34c8b5abf1f6d5feff99b7e9156cbfc4a0c55188fd60ff62cc83
MD5 30385bf4022d9568cb66a0d963441c9f
SHA1 58767875914ffd03795a3d53893a5c5cb638054d
SHA512 ca6c6e409559008cd417a53f3fe60834c9e1c1c511dac24c7ed8b264ad4032a146ae2158651814ab9e7e8b3a74c0ce88f409cb7ea28e859b169bea851c892791
TLSH
T134212BA98A2EE70705C2423E8B6CCA21CA5841FA1306FD8273ECC74835D428C43BC3A4
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1580	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\gemini-code-1786563359509.bat"
1⤵
- Executes a command shell one-liner
PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads