🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2
SHA3-384 hash: a3f81253ac27eda24d8aeb75919361b6e9c3e33d6b59f2bed11d474c34b2567b1c3da387b44350fe2df4f32ab18879f1
SHA1 hash: 660e2c527b5ea6ea01fe7637d268942e920f230f
MD5 hash: 3cc98fa478506b1294f70aaf37df609a
humanhash: moon-utah-fish-texas
File name:6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2.bin
Download: download sample
File size:33'442 bytes
First seen:2026-11-15 00:41:24 UTC
Last seen:Never
File type:php php
MIME type:text/x-php
ssdeep 768:ReM0pv7jMmal2Ts1eM0p0d1MSmsmalW8m4:AZZwITtZWdfTI8m4
TLSH T133E25DB130A950BA9017D3EA222F775D397310A3D352C1C5BEFD4BA09BC1D6B5E269C8
TrID 62.5% (.PHP) PHP source (5000/1)
37.5% (.HTML) HyperText Markup Language (3000/1/1)
Magika php
Reporter Tuxxin
Tags:php

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af8ffe2fc945c1ebf2a2ed3
Tags:
fakeapp virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
captcha masquerade obfuscated
Link:
https://www.filescan.io/uploads/6af8ffe3f1b8cb5ced2a560f/reports/9e74569d-2d41-4971-858e-064b2825ccab/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2
Verdict:
Unknown
File Type:
js
Link:
https://opentip.kaspersky.com/6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2/results?tab=lookup
Score:
48%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2/
Threat name:
Document-HTML.Trojan.FakeCaptcha
Create hunting rule
Status:
Malicious
First seen:
2026-05-03 09:53:00 UTC
File Type:
Text (PHP)
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ns3c4ilhtpdhzle2lv5s73blcf6atl7y2zc6yg3tftkpitlfndra._file
Malware Family:
fakecaptcha
Create hunting rule
Malicious:
True
Tags:
php
Link:
https://intel.virussign.com/intelligence/file/6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MULTI_Malware_RemcosRAT_ForgeAuto_4785f0c3
Create hunting rule
Author:Marjoriefort
Description:Detects RemcosRAT (inconnu, etat binaire)
Rule name:OBFUS_PowerShell_Common_Replace
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the common usage of replace for obfuscation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

php php 6cb62e21679bc67cac9a5d7b2fec2b117c09aff8d645ec1b732cd4f44d6568e2

(this sample)

  
Delivery method
Distributed via web download

Comments