🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c8254ea2e81a3de70e26111ac9d3cfd71ae536f0acf69e1fca3067865b415eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Panchan


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c8254ea2e81a3de70e26111ac9d3cfd71ae536f0acf69e1fca3067865b415eb
SHA3-384 hash: 20a736f4942d8f5c252e6151b2dfc290007bf73f46848b3dade58810cb35d846a32a71a94cfcde87bd4bb0f5f8b2ccbc
SHA1 hash: 22aed4f35c844f55924fa01fa73e5547d21af796
MD5 hash: 1950c30e7a9072e6b465a54501627466
humanhash: ohio-batman-pennsylvania-autumn
File name:9da0c0efa33ad88e8a7eb5997d8f5586e1837dff00bb3352195e574a49c25baa.zip
Download: download sample
Signature Panchan
Create hunting rule
File size:6'773'257 bytes
First seen:2026-11-12 09:53:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: infected
ssdeep 196608:iUjlDxplrG67cIReGiq1UMyMORqGN9KJ3j:jPrGYN4aUMyMOrnC
TLSH T18E6633DCC725BDCECE711ECDC3411A76BA1CA8EF470907B6685E95DA5BAE80D09482CC
Magika zip
Reporter DarkDataLabs
Tags:Panchan

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
US US
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:9da0c0efa33ad88e8a7eb5997d8f5586e1837dff00bb3352195e574a49c25baa
File size:14'745'600 bytes
SHA256 hash: 9da0c0efa33ad88e8a7eb5997d8f5586e1837dff00bb3352195e574a49c25baa
MD5 hash: 0f194a1a0b9c308cbd008e286bc12179
MIME type:application/x-executable
Signature Panchan
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fd557675-f9ab-4c4b-b4d0-c36f81b486d4/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af58dbbc48f25399eb55880
Tags:
n/a
Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/4c8254ea2e81a3de70e26111ac9d3cfd71ae536f0acf69e1fca3067865b415eb/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm base64 bash fingerprint lolbin obfuscated
Link:
https://www.filescan.io/uploads/6af58edee2f5d5c0c4f9df4c/reports/b2371c76-f343-4964-9c26-67c37376b939/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/4c8254ea2e81a3de70e26111ac9d3cfd71ae536f0acf69e1fca3067865b415eb
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/4c8254ea2e81a3de70e26111ac9d3cfd71ae536f0acf69e1fca3067865b415eb
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Elf Executable Executable Zip Archive
Link:
https://app.malva.re/file/1950c30e7a9072e6b465a54501627466
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c8254ea2e81a3de70e26111ac9d3cfd71ae536f0acf69e1fca3067865b415eb/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jsbfj2roqgr544hcmei2zhj47vy24u3pblhwtyp4umdhqznucxvq._file
Result
Malware family:
panchan
Create hunting rule
Score:
  10/10
Tags:
family:panchan botnet linux
Link:
https://tria.ge/reports/261112-lz5m9see38/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/4c8254ea2e81a3de70e26111ac9d3cfd71ae536f0acf69e1fca3067865b415eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments