269526c11dbb25b1b4b13eec4e7577e15de33ca18afa70a2be5f373b771bd1ab

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/LuaSocket/lua/socket/url.bat
Size 10KB
Sample261002-ml89zagd43
SHA256 269526c11dbb25b1b4b13eec4e7577e15de33ca18afa70a2be5f373b771bd1ab
MD5 8fb662c362da002b833793ea7794fdaf
SHA1 7afaf1ad22c95690cbb3f55226b617121efc20eb
SHA512 b0b766ac2b5cff879009ad9f74295f7ab0bf8b0628b8aece5597243e0fa96f4a85361728fd8a08eea7d2629dfc5e5d8b6aebca432075ad74c131ad3161a475c7
SSDEEP 192:zF/d/WjwnQdkUDv7wIECAAA4HaHjCRBxj6AqyQUh/T1htnSDiKbn:zfWjwXUDv7uCAx4HaD+Bxj6AqK/TTsiY
TLSH
T14422FE2C3D82E222EAF1E7538EBF0985F118916311691528B5CC14D53F3692CB6FFA75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1420	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaSocket\lua\socket\url.bat"
1⤵
- Executes a command shell one-liner
PID:1420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads