MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63f03e56a69b0181d821b5b0ae5a788ce9a54d10d94b80a48cb59b9da0b5cf7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	63f03e56a69b0181d821b5b0ae5a788ce9a54d10d94b80a48cb59b9da0b5cf7b
SHA3-384 hash:	85ed944450240c9e01d3732af4b99c9b0565b54ad46a1405267d0cab8e90a547f61b908bed15d3a4abf849fe0df72718
SHA1 hash:	bff2d55a2dacde88a8676db7cc0393e64dedaaa1
MD5 hash:	4085b9ffb43b1e9950601de817a86c52
humanhash:	fish-yankee-oregon-north
File name:	create.py
Download:	download sample
File size:	5'182 bytes
First seen:	2025-03-03 12:41:34 UTC
Last seen:	Never
File type:
MIME type:	text/plain
ssdeep	96:1u6d+u8UDAt+S+cYmH13QhSCqgIqdmisy7P:BsJH13QhSCZIqdzsy7P
TLSH	T1F1B1139ABA220B760D2CDF53F27184A5B063D1CA04908F1974FD70F8FEBED54A61066B
Magika	txt
Reporter	abuse_ch
Tags:	py

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

101

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c5a442c8d04e92a4bea6d0

Tags:

n/a

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67c5a3a43c5f644bd94037af/reports/697a4888-0cc4-47b5-9307-e92c3681c68a/overview

Hybrid Analysis SH/Mirai.D.gen

Verdict:

Suspicious

Labled as:

SH/Mirai.D.gen

Link:

https://www.hybrid-analysis.com/sample/63f03e56a69b0181d821b5b0ae5a788ce9a54d10d94b80a48cb59b9da0b5cf7b

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/63f03e56a69b0181d821b5b0ae5a788ce9a54d10d94b80a48cb59b9da0b5cf7b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/63f03e56a69b0181d821b5b0ae5a788ce9a54d10d94b80a48cb59b9da0b5cf7b/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-03 12:42:20 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mpyd4vvgtmaydwbbwwyk4wtyrtu2ktiq3ffybjemwwnz3ifvz55q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250303-pxgefayjt8/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/63f03e56a69b0181d821b5b0ae5a788ce9a54d10d94b80a48cb59b9da0b5cf7b