806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a

Classification: Malicious

806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a is a malicious file sample. Reported by 1 threat source, last seen 2026-09-02.

Detection summary

  • 0 antivirus detections
  • 1 IDS alerts
  • 19 processes observed
  • 5 contacted hosts
  • 3 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-09-06 22:30:03 2026-09-02 15:45:06 malicious-activity

Tags

malicious windows-server-utility

Sample information

Filenames
806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a, Setup1.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
13805971 bytes
MD5
56c671ca2f1c447d9626235f396c870a
SHA-1
3bc86393d8b3f0e20e8b49466c48c0a54a03fd61
SHA-256
806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a
First indexed
2024-09-06 22:09:46
Last updated
2026-09-02 15:45:06

Network contacts

103.130.147.211 194.87.248.136 62.133.62.93 194.58.114.223 162.159.135.233

DNS requests

58yongzhe.com cdn.discordapp.com tventyv20pt.top

Process list

NameCommand line
Setup1.exe
WScript.exe"%TEMP%\RarSFX0\run.vbs"
build_4.exe
build_4.exe
cmd.exe%WINDIR%\system32\cmd.exe /c "cscript.exe %PUBLIC%\make.vbs"
cscript.exe%PUBLIC%\make.vbs
cmd.exe/c taskkill/IM %PUBLIC%\Channel4.exe /F /t
taskkill.exetaskkill /IM %PUBLIC%\Channel4.exe /F /t
cmd.exe%WINDIR%\system32\cmd.exe /c "del %PUBLIC%\make.vbs"
powershell.exe-WindowStyle hidden -Command "saps %PUBLIC%\Channel4.exe"
Channel4.exe
cmd.exe%WINDIR%\system32\cmd.exe /c "cscript.exe %PUBLIC%\make.vbs"
cscript.exe%PUBLIC%\make.vbs
cmd.exe/c taskkill/IM %PUBLIC%\File1.exe /F /t
taskkill.exetaskkill /IM %PUBLIC%\File1.exe /F /t
cmd.exe%WINDIR%\system32\cmd.exe /c "del %PUBLIC%\make.vbs"
powershell.exe-WindowStyle hidden -Command "saps %PUBLIC%\File1.exe"
cmd.exe%WINDIR%\system32\cmd.exe /c "cscript.exe %PUBLIC%\make.vbs"
cscript.exe%PUBLIC%\make.vbs