MalwareTipsTools

File scan report

Scan another file

Verdict Malicious

Analyzed , 1 day ago

Is Install_New_theme.bat safe? No, we rate this exact file malicious.

Three of the 60 antivirus engines that checked it, including ESET, classify this batch script as a PowerShell hacking tool that pulls remote code and alters the Spotify client.

Moderate evidence · Several antivirus engines agree.

Remove it unless you use it on purpose

Do not run this script. If it has already run, review the Spotify installation, scheduled tasks and uninstall entries it created, and run a full scan with your security software kept fully enabled.

What to do now4 steps

This is a hacking tool. It is risky to keep and run, but finding it is not by itself a sign that the device is infected.

What to do

  1. Don't run it unless you got it on purpose for security testing on systems you own. Delete it, then empty the Recycle Bin.

  2. If you didn't put it on the device yourself, delete it and run a full antivirus scan: something else may have brought it.

  3. Tools like this often come with cracked or pirated software. If it came that way, treat the whole download as unsafe and scan everything it installed.

If you already ran it

  1. Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

If you opened or installed it

Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Share this file report

Install_New_theme.bat: Malicious — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Antivirus results

3 of 60 flagged

  • Flagged 3
  • No detection 57
  • No result 15
FileInstall_New_theme.bat609 BSHA-256 7f60a4179212…ca34b1
  • Code signing Not applicable
  • Test run Completed
  • First seen 4mo ago
When we scanned it, 1,103 sources had submitted it to VirusTotal (1,208 submissions).

Chapter 02

Why we think so

6 points against it and 4 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

All three detections on this batch script are hacking-tool labels, one of them from ESET, and the sandbox shows it launching a remote PowerShell script and downloading an installer from a third-party address with certificate checks switched off. It is a Spotify modification tool rather than a classic trojan, but it runs code of someone else's choosing on your machine, so it should not be executed.

Full reasoning

The file is a 609-byte batch script that does nothing locally except start PowerShell and hand control to a remote script. In the sandbox runs it fetched that script from a public code-hosting address, then used the built-in downloader to pull a Spotify installer from a Cloudflare-hosted mirror with certificate revocation checking disabled, launched it, and created a scheduled task. Three engines label it as PowerShell hacking tooling and none names a malware family, which is consistent with what the behaviour shows: an ad-stripping patch utility for the Spotify desktop client, distributed as a script that executes code chosen by whoever controls the download address. Because the labels are corroborated hacking-tool findings rather than a single uncertain engine, and because the script both downloads and executes remote content, the evidence supports treating it as unwanted tooling rather than a benign installer. The network reputation check found no known-bad contact points and the file is widely shared, which argues against a targeted attack, but neither makes the remote-execution chain safe.

Detailed assessment

What We Detected

This is a very small batch script (609 bytes) whose only job is to bootstrap a much larger operation. Three of the 60 antivirus engines that checked it flag it, and every one of those labels is in the hacking-tool category: ESET reports a PowerShell hacking tool and notes it as a potentially unsafe application, Kingsoft uses a generic hacking-tool name, and a less reliable engine returns a similar generic label. No engine names a ransomware, banking or spyware family, and there is no family consensus among the highest-trust engines.

Alongside the engine labels, one of our behaviour rules matched the security/research-tooling pattern, based entirely on those hacking-tool labels rather than on any trojan signature.

Threat Behavior

Three sandbox runs were recorded. The script starts a command shell, launches PowerShell, and follows an instruction set stored on a public code-hosting service rather than on disk. From there it downloads a Spotify installer from a Cloudflare-hosted address that is not the vendor's own download site, and it does so with certificate revocation checking turned off — a choice that has no legitimate reason in a consumer installer and removes a safety check on the transfer.

The installer is then started, and the run records a scheduled task being created along with a long list of registry changes under the Spotify software key and temporary files written into the user's Spotify profile. There are also matching artefacts for Spotify update program markers. In plain terms: it silently rewrites and re-installs the Spotify client on the machine.

Two cautions about how to read the rest of the behaviour data. The scheduled-task creation is real but is also something legitimate installers do for their own updaters, so it is weighed as context rather than as proof of intent.

What To Do Now

Do not run the script. If it has already been run, check the installed Spotify client, review scheduled tasks and the software uninstall entries created under the current user, and run a full scan with your existing security software left fully enabled. If the goal was ad-free listening, use the standard client or a paid subscription rather than a patch script that executes remote code on your behalf.

Where this verdict could be wrong3 caveats
  • The strongest label reads 'potentially unsafe application', which describes the tooling class rather than confirmed payload harm; the script's stated purpose is stripping ads from the Spotify client, so real-world risk depends on how it is used.
  • The executable is fetched from a mirror address rather than the project's own site, so whoever controls that address — not the project maintainers — decides what actually gets installed.
  • The sandbox runs recorded no overall malicious verdict, and nobody inspected the script's bytes here, so intent is inferred from behaviour and engine labels rather than from the code itself.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour
  • 57 of the 60 engines that analysed the file returned no detection at all.
  • The file is widely shared — over a thousand distinct sources — rather than a rare, targeted sample.
  • The remote PowerShell stage is hosted in a public open-source project's repository rather than an anonymous payload host.
  • Our host reputation check covered every address the sample contacted and found none known to be malicious.
Points against
  • Three engines, including a high-reputation one, classify the script as PowerShell hacking tooling.
  • The script contains no real work of its own: it starts PowerShell and executes a script hosted on the internet.
  • The Spotify installer it fetches comes from a third-party mirror address, not from the vendor's own download site.
  • The download is performed with certificate revocation checking switched off, removing a check on what is being retrieved.
  • A scheduled task is created during execution, leaving something behind that runs without the user starting it.
  • It modifies an already-installed Spotify client, including its uninstall entries and application files.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 3 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 3isolated sandbox runs
  • 28sandbox rule tags
  • 12spawned processes
  • 5network contacts
  • 36filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

  • Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).

  • Moderate concern: Ran commands or a script on the test computer.

  • Moderate concern: Downloaded a file during the test run.

  • Moderate concern: Checked whether it was running on a test computer.

  • Moderate concern: Hid files or windows on the test computer.

  • Note: Read the user name of the test computer.

  • Note: Listed the programs running on the test computer.

Sandbox labels we could not confirm (common in safe files too)

  • Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.

  • Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.

  • Not confirmed: A sandbox rule tagged this run as setting up auto-start; no auto-start entry was recorded.

  • Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Threat context

How hacking tools are used

Hacking tools are programs that can switch off security software, test passwords or attack other computers. Security professionals use them on purpose; criminals also bundle them with malware.

Bottom line:Keep it only if you installed it on purpose, and check how it got onto the device if you didn't.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

  1. Input file

    The submitted object

    1
    1. Evidence 1 of 7: FileSeen in the test run

      Install_New_theme.bat

      7f60a4179212c4b85d3af563987f047c7d416621803e5d2187cbcdfe8bca34b1

      Uploaded file

  2. Processes

    What ran

    2
    1. Evidence 2 of 7: ProcessSeen in the test run

      schtasks.exe

      C:\Windows\System32\schtasks.exe

      Test run
    2. Evidence 3 of 7: ProcessSeen in the test run

      cmd.exe

      "C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\Desktop\Install_New_theme _1_.bat"

      Test run
    3. +1 more recorded observation

  3. Files

    Created or changed

    2
    1. Evidence 4 of 7: Written fileSeen in the test run

      ModuleAnalysisCache

      C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

      Test run
    2. Evidence 5 of 7: Written fileSeen in the test run

      SpotifySetup.exe

      C:\Users\<USER>\AppData\Local\Temp\SpotX_Temp-2026-06-16_18-55-50\SpotifySetup.exe

      Test run
    3. +1 more recorded observation

  4. Network

    Hosts contacted

    2
    1. Evidence 6 of 7: Contacted hostSeen in the test run

      raw.githubusercontent.com

      Contacted during the test run.

      Test run
    2. Evidence 7 of 7: Contacted hostSeen in the test run

      loadspot.amd64fox1.workers.dev

      Contacted during the test run.

      Test run
    3. +1 more recorded observation

7 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was detonated in 3 sandboxes and its runtime behaviour was observed.

Techniques observed in the sandbox

28

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1027· Obfuscated code
  • T1033· Reads user info
  • T1036
  • T1047
  • T1055· Process injection
  • T1057· Lists programs
  • T1059· Runs commands
  • T1059.001· Runs commands
  • T1064
  • T1071· Application protocol
  • T1074
  • T1082· System recon
  • T1105· Network file transfer
  • T1106
  • T1112
  • T1129· Loads modules
  • T1202
  • T1485
  • T1486· File encryption
  • T1497· Sandbox evasion
  • T1518· Checks your AV
  • T1539
  • T1547· Auto-start
  • T1547.001· Auto-start
  • T1562· Disables security
  • T1564· Hides artifacts
  • T1573
  • T1574· Execution hijack

Observed activity

Processes started
12

Programs the file ran, with their command lines.

  • schtasks.exeC:\Windows\System32\schtasks.exe
  • cmd.exe"C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\Desktop\Install_New_theme _1_.bat"
  • cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\Desktop\Install_New_theme _1_.bat"
  • powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-new_theme -no_pause'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/SpotX/refs/heads/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/SpotX/run.ps1' })} $p """" | iex
  • curl.exe"C:\Windows\system32\curl.exe" -V
  • curl.exe"C:\Windows\system32\curl.exe" --help all
Show all 12 entries for processes started
  • curl.exe"C:\Windows\system32\curl.exe" -q -L -k --fail --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\<USER>\AppData\Local\Temp\SpotX_Temp-2026-06-16_18-55-50\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.92-x64.exe
  • explorer.exe"C:\Windows\system32\explorer.exe" C:\Users\<USER>\AppData\Local\Temp\SpotX_Temp-2026-06-16_18-55-50\SpotifySetup.exe
  • explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
  • SpotifySetup.exe"C:\Users\<USER>\AppData\Local\Temp\SpotX_Temp-2026-06-16_18-55-50\SpotifySetup.exe"
  • Spotify.exeSpotify.exe /INSTALLCOMPLETE
  • cmd.exeC:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Install_New_theme (1).bat" "
Network contacts
5

5 hosts, listed as 2 domains, 3 addresses, 4 links. Links show the host and path only.

  • Domainraw.githubusercontent.com
  • Domainloadspot.amd64fox1.workers.dev
  • IP address185.199.110.133
  • IP address172.67.210.237
  • IP address185.199.111.133
  • URLhttps://raw.githubusercontent.com/SpotX-Official/SpotX/refs/heads/main/run.ps1
Show all 9 entries for network contacts
  • URLhttps://raw.githubusercontent.com/SpotX-Official/SpotX/main/scripts/installer-lang/en.ps1
  • URLhttps://raw.githubusercontent.com/LoaderSpot/table/refs/heads/main/table/versions.json
  • URLhttps://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.92-x64.exe
Files
30

Files the file created, changed or deleted.

  • WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
  • WrittenC:\Users\<USER>\AppData\Local\Temp\SpotX_Temp-2026-06-16_18-55-50\SpotifySetup.exe
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_0_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_2_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_4_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_6_~
Show all 30 entries for files
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_8_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_10_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_12_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_14_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_16_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_18_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_20_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_22_~
  • WrittenC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_24_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_0_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_2_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_4_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_6_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_8_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_10_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_12_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_14_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_16_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_18_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_20_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_22_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_24_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_26_~
  • DeletedC:\Users\<USER>\AppData\Roaming\Spotify\~TMP_5052_28_~
Registry and auto-start
16

Settings the file changed, including ways to start again after a restart.

  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\DisplayIcon
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\DisplayName
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\DisplayVersion
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\Version
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\InstallDate
Show all 16 entries for registry and auto-start
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\InstallLocation
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\NoModify
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\NoRepair
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\Publisher
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\UninstallString
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\QuietUninstallString
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify\URLInfoAbout
  • SetHKEY_CURRENT_USER\Software\Classes\AppUserModelId\Spotify.desktop.client\IconUri
  • SetHKEY_CURRENT_USER\Software\Classes\AppUserModelId\Spotify.desktop.client\DisplayName
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify Web Helper
Mutexes
6

Named locks a program uses so only one copy runs; malware families often reuse them.

  • Spotify Update Started Interactive Mutex
  • Spotify Update Started Mutex
  • cversions.3.m
  • Local\MSCTF.Asm.MutexDefault0
  • Global\SQMWindowsConsolidator
  • Global\G{C4F406E5-F024-4e3f-89A7-D5AB7663C3CD}
Sandbox background — not the file
3

The analysis machine's own processes and connections, recorded in every run.

  • VM processservices.exeC:\Windows\system32\services.exe
  • VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
  • VM processExplorer.EXEC:\Windows\Explorer.EXE
Dropped payload

Files this sample writes at runtime

This file drops 8 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.

8 not checked
  • 2cd6bb280e9728b27b12…fff616Not checked
    no saved verdict
  • f7f642c4662a599c1a4a…6acc30Not checked
    no saved verdict
  • b0d12fd7ab2b5a3bbae1…e7dc52Not checked
    no saved verdict
  • d58fc6eb323e73b367a5…9f6c34Not checked
    no saved verdict
  • 6722abb3265dc6b8cf32…564fecNot checked
    no saved verdict
  • 2ad6dead42e178d55ec3…963556Not checked
    no saved verdict
  • 978258bb913d31e6e451…f23910Not checked
    no saved verdict
  • 141a0bfbb9cda2f6a394…364e80Not checked
    no saved verdict

Chapter 04

Technical details

3 of the 60 antivirus engines that checked it flag it.

Sources checked

Every check behind this verdict

6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompleteRisk signal: 3 of 60 engines flagged it · 15 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxes · CAPE Sandbox, Rising MOVES, ZenboxComplete3 runs, no sandbox verdict recorded Details for sandbox run
Contacted hostsMalwareTips URL scannerComplete5 contacted hosts checked Details for contacted hosts
Signature rulesYARAify community rules + MalwareTips rulesCompleteWorth noting: 2 MalwareTips behaviour rules Details for signature rules
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

Engines that flagged it 3

  • ESET-NOD32 (major engine)PowerShell/HackTool.Agent.ED potentially unsafe application
  • alibabacloudHackTool:Win/Agent.EF
  • KingsoftWin32.HackTool.Undef.a

File fingerprint

Last analyzed
Nov 9, 2026, 2:23 PM UTC
SHA-256
7f60a4179212c4b85d3af563987f047c7d416621803e5d2187cbcdfe8bca34b1
SHA-1
47d99f3b9de5d64499b94465a1a59a9df00f174f
MD5
848abf2f8f70e00ff045c46d519f9e18

About this file

Install_New_theme.bat is a DOS batch file file of 609 B.

Type and size
DOS batch file · 609 B
Signer
Not applicable
First seen
Jun 16, 2026On VirusTotal.
Submitted by
1,103 distinct sources

First scanned

Antivirus consensus

3 of 60 engines flagged this file

3 malicious0 suspicious57 not flagged15 no result

15 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

  • Tier-118 engines
    1flagged
  • Tier-231 engines
    1flagged
  • Low-trust11 engines
    1flagged
View all 75 engine results
  • alibabacloudMalicious: HackTool:Win/Agent.EF
  • ESET-NOD32Malicious: PowerShell/HackTool.Agent.ED potentially unsafe application
  • KingsoftMalicious: Win32.HackTool.Undef.a
  • AcronisClean
  • AhnLab-V3Clean
  • AlibabaNo result
  • ALYacClean
  • Antiy-AVLClean
  • APEXNo result
  • ArcabitClean
  • AvastClean
  • Avast-MobileNo result
  • AVGClean
  • AviraClean
  • BitDefenderClean
  • BitDefenderFalxNo result
  • BkavClean
  • CAT-QuickHealClean
  • ClamAVClean
  • CMCClean
  • CrowdStrikeClean
  • CTXNo result
  • CylanceNo result
  • CynetClean
  • DeepInstinctNo result
  • DrWebClean
  • ElasticNo result
  • EmsisoftClean
  • F-SecureClean
  • FortinetClean
  • GDataClean
  • GoogleClean
  • GridinsoftClean
  • huorongClean
  • IkarusClean
  • JiangminClean
  • K7AntiVirusClean
  • K7GWClean
  • KasperskyClean
  • LionicClean
  • MalwarebytesClean
  • MaxSecureClean
  • McAfeeDClean
  • MicrosoftClean
  • MicroWorld-eScanClean
  • NANO-AntivirusClean
  • PaloaltoNo result
  • PandaClean
  • RisingClean
  • SangforClean
  • SentinelOneNo result
  • SkyhighClean
  • SophosClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisNo result
  • TencentClean
  • TrapmineNo result
  • TrellixENSClean
  • TrendMicroClean
  • TrendMicro-HouseCallClean
  • TrustlookNo result
  • VaristClean
  • VBA32Clean
  • VIPREClean
  • VirITClean
  • ViRobotClean
  • WebrootNo result
  • XcitiumClean
  • YandexClean
  • ZillyaClean
  • ZoneAlarmClean
  • ZonerClean
Rule-based evidence

Signatures and behavior heuristics

Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.

2 heuristics
MITRE ATT&CK profile
Persistence× 1Defense evasion× 1
Behavior heuristics
Deterministic patterns derived from scan data and observed runtime behavior
  • PersistenceScheduledTask
    T1053.005
    medium

    The sandbox recorded persistence through a scheduled task. Installers set these up legitimately for their own updaters and services, so this is context, not proof of malicious intent.

    Evidence
    C:\Windows\System32\schtasks.exe
  • ProcessInjection
    T1055
    low

    VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.

    Evidence
    T1055 (sandbox MITRE mapping)
Prevalence

How widely this file has been seen

Widely uploaded, but first seen within the last six months. No strong prior applies.

Common
Unique uploaders
1,103
Hundreds of people have uploaded this — common.
Total submissions
1,208
Includes repeat uploads by the same source.
First seen
5mo ago
Jun 16, 2026
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 8 questions people ask most about this file.

Is Install_New_theme.bat malware?
Install_New_theme.bat is a hacking tool. It is flagged because it can be misused, not because it infects a device by itself. Keep it only if you use it on purpose; otherwise, delete it, then empty the Recycle Bin. 3 of the 60 antivirus engines that checked it flag it.
What is Install_New_theme.bat?
Install_New_theme.bat is a batch script, about 609 bytes. VirusTotal first saw it on Jun 16, 2026.
How many antivirus engines detected Install_New_theme.bat?
3 of the 60 antivirus engines that checked it flag Install_New_theme.bat, including ESET and Kingsoft. We weigh which engines flagged it and what else the scan found, not just the count. The rating comes from all the evidence together, not from this count alone.
I already downloaded and ran Install_New_theme.bat — what should I do?
1) If you ran it on purpose, for testing on systems you own, remove it when you are done. 2) If you didn't download it yourself, delete it and run a full antivirus scan: something else may have brought it. 3) If it came with cracked or pirated software, treat that whole download as unsafe, scan everything it installed and change passwords you typed on the device since.
How do I remove Install_New_theme.bat?
To remove Install_New_theme.bat: 1) Delete it, then empty the Recycle Bin. 2) Run a full scan with your antivirus to check that nothing else came with it. 3) Check Settings > Apps and your startup apps for anything you don't recognise.
What kind of program is Install_New_theme.bat?
Antivirus engines classify Install_New_theme.bat as a hacking tool: a program that can switch off security software, test passwords or attack other computers.
What is the SHA-256 hash of Install_New_theme.bat?
The SHA-256 fingerprint of Install_New_theme.bat is 7f60a4179212c4b85d3af563987f047c7d416621803e5d2187cbcdfe8bca34b1, and its MD5 is 848abf2f8f70e00ff045c46d519f9e18. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
How up to date is this analysis of Install_New_theme.bat?
This report reflects the scan on Nov 9, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Recent reports on other files with the same rating.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.