3bc320b8c3b39db164e92a045ffee8869752fe12c253ff2143d3632123cb481d

Resubmissions

19/08/2026, 00:21

260819-and6dsvxgt

19/08/2026, 00:17

260819-aljcbstdkd3

Analysis

max time kernel
8s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/08/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
z7fclient.bat
Size 58KB
Sample260819-aljcbstdkd
SHA256 3bc320b8c3b39db164e92a045ffee8869752fe12c253ff2143d3632123cb481d
MD5 ac0963038604594d87569da5c9e452de
SHA1 65011db2e1a391768c53c27118ebc8e8d8d06cd3
SHA512 2dc680a96a38d595b16f73f64258df11f44b0444686e1ebd577c942933a232d0701856ddd36a952b1ade9a2965ec2707de71c755a907227abfc85f6aaa38e29a
SSDEEP 768:BkRIbDnDSgr4j3Mjcflyk6uMCOHDTw+0Bsu1wRxkSUN+1XFJuvw1bSfMVRKqSUq/:lbr2grwM/uzUU7KMVNSFkvwIQbO
TLSH
T122431A0AF34364ECD51AC67486EB6773FA71BC6601359B3F4750DA312E10E60AE7AB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1384	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\z7fclient.bat"
1⤵
- Executes a command shell one-liner
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads