MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f
SHA3-384 hash: 07b56d54baf6cab365a634ae16d5b82b798b540a461070a83ef99e1a7621178c095a6bb424b7481a90a2365fa9b19397
SHA1 hash: 450cf075f32d1eaa8df5426cbf40954be60b9ec7
MD5 hash: 19068f87e4710a6f748d550d46227f73
humanhash: two-texas-apart-snake
File name:47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f.py
Download: download sample
File size:1'004 bytes
First seen:2025-04-18 06:37:38 UTC
Last seen:Never
File type:
MIME type:text/x-script.python
ssdeep 24:IgLEwOdoeHh5HFhyv1F2exFQJLebffbifbv:dnOdoYvHFsNF2exFyLem
TLSH T19A11B144E2673525D3939B012A1474E703DFA843D7DB0DF8394C57D19F458F592842AF
Magika python
Reporter JAMESWT_WT
Tags:py slow-pisces YAML Deserialization Payload

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6801faad2203b3e10cd0d5ca
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6801f7ca89fec6b88b9ef24b/reports/c3160c87-d209-4e5a-8fc4-defcabd988ff/overview
Verdict:
Suspicious
Labled as:
Python/Agent.BBE trojan
Link:
https://www.hybrid-analysis.com/sample/47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f
Score:
7%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f/
Threat name:
Script-Python.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2025-04-14 12:07:07 UTC
File Type:
Text (Python)
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7uzpoc62p2r2ky5g6tkmgxhegc5ttvpkgpc7w2tx57hmg33ychq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250418-hq1feaxrw2/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Project Hook POS
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/

Comments