MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5981eeb3cacfbd2e50b63c7f1db9c839b4f7f1c89099fd7c910d338afb06708a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5981eeb3cacfbd2e50b63c7f1db9c839b4f7f1c89099fd7c910d338afb06708a
SHA3-384 hash:	ec2023e8ec755f009b86a6a310ccc107be2474ebb9ccbfbf644b5c88ca86bf50852ef8d23704ef9956ced9305729923b
SHA1 hash:	9e36da24f4d978b70b0fa8c322befd3980a7a138
MD5 hash:	59a3d4a6553c49f2aca1e9c451794523
humanhash:	beer-virginia-west-carpet
File name:	class-loader.php
Download:	download sample
File size:	9'161 bytes
First seen:	2026-10-03 08:18:09 UTC
Last seen:	Never
File type:	php
MIME type:	text/x-php
ssdeep	192:lFf8TxmE9hnnh4SgDj2Mgimji626W5pYXHI:lJ8VP2SMgI60pV
TLSH	T11F12B903B8C12D67C16412BED21F8207E17DBB6A259C9801B533FD9E5E7221CD1B6DB5
Magika	emilstahl
Reporter	emilstahl
Tags:	Castle ClickFix doublecup php webshell wordpress

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

72

Origin country :

DK

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5981eeb3cacfbd2e50b63c7f1db9c839b4f7f1c89099fd7c910d338afb06708a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-01T07:14:00Z UTC

Last seen:

2026-10-04T18:44:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5981eeb3cacfbd2e50b63c7f1db9c839b4f7f1c89099fd7c910d338afb06708a/results?tab=lookup

Nucleon Malprob Benign

Score:

16%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5981eeb3cacfbd2e50b63c7f1db9c839b4f7f1c89099fd7c910d338afb06708a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5981eeb3cacfbd2e50b63c7f1db9c839b4f7f1c89099fd7c910d338afb06708a/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-03 09:03:24 UTC

File Type:

Text (PHP)

AV detection:

3 of 24 (12.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lga65m6kz66s4ufwhr7r3ooihg2pp4oiscm727erbuzyv6ygocfa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI DriveBy Activity

Threat name:

DriveBy Activity

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/5981eeb3cacfbd2e50b63c7f1db9c839b4f7f1c89099fd7c910d338afb06708a