38fdecdc08971d4bb244b7e3e0d83c1e50252ea696549c4808fa52e96367ae51

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xui2.0/Makefile.bat
Size 11KB
Sample260818-pg217stsbv
SHA256 38fdecdc08971d4bb244b7e3e0d83c1e50252ea696549c4808fa52e96367ae51
MD5 fc8d25e82d4f1d9266bf7e04f64014a2
SHA1 d91248afbbd802103adc91eddaf3250aaa20240e
SHA512 6a715645e02e48dd4f42bc105ef5cc492e037696eb78de441e3ecb0079bf910859126f3f05320e30365038cf11f7d009a7c321e0b5e418de53825099b26cecc7
SSDEEP 96:dbU8NpeXGNZzZWAl7i19X9fFxOEgPsKXCgozA/iO/OM4MVg4jt72uZf/wQP5GV06:agVQAlO1zeEgPagoG4MVg4R72kX838c
TLSH
T19D326675E35C8C65364DC3FCFB16C4076409F5CA7F1225248DEAFA6892DC2C422EA675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
836	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xui2.0\Makefile.bat"
1⤵
- Executes a command shell one-liner
PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads