08a017647a254ee42176e0be5f78c9edf63a548d2c43f0c451ba567f81940c3f

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
freeciv-3.2.6/ai/stub/Makefile.bat
Size 31KB
Sample261027-bga1tscd46
SHA256 08a017647a254ee42176e0be5f78c9edf63a548d2c43f0c451ba567f81940c3f
MD5 5b10ca4564f04b6af53fcb4395330437
SHA1 29691bac6c899ae90ba2422315167e924d881639
SHA512 96a318b5118ab33289698a82d140bda72f7d8b3315e844ebcd0d1ba7cbb6fe0bc6c1b13a14ea5a2ee7429a3b80a6eb77581ddb147642d1720126e28d43d6a5aa
SSDEEP 768:lspDBTSKW8S9KnLJJlhicBxdyY2PSnzTIr+Y94tB9oBY9+/AJHP3LLgw7MaEaj5S:lspD5SKW8S9+i9Y2KnbwmJHDLgw7MaE3
TLSH
T19DE2D67AE82E2C73B614A1D569BFA286A8C3517503192E753F8DBF48234D04721BF937
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2652	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\freeciv-3.2.6\ai\stub\Makefile.bat"
1⤵
- Executes a command shell one-liner
PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads