MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f96919e74c0d3882b8651f58ce41a128a67630871118522cb73f1752898e57f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6f96919e74c0d3882b8651f58ce41a128a67630871118522cb73f1752898e57f
SHA3-384 hash:	1e262e071779284138b00df0003d2d43b425621f2c13bc844f8c7cac2e7780fe6baecd42654b4986ddbd8f1afb606d0e
SHA1 hash:	3639e69ac7ce0b2d13d7b3564d441d15a24d0bc0
MD5 hash:	bc214eaf2f6ed77363bc88909079a943
humanhash:	bluebird-jersey-failed-black
File name:	create.py
Download:	download sample
File size:	5'166 bytes
First seen:	2025-07-24 02:00:44 UTC
Last seen:	Never
File type:
MIME type:	text/plain
ssdeep	96:UIuUdbU80sGGkKcCEw849QI0SKcmgyw1+oKltFuawin:UWKLQ9b0SKctywwfzk3i
TLSH	T13EB15B9AB63643724D28DF13F215C539B00BC18685529F9534BBF0BCBDB7D49E942326
Magika	txt
Reporter	abuse_ch
Tags:	py

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

57

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=688193e62f623871a5f2bf18

Tags:

n/a

Hybrid Analysis TrojanDownloader/Linux.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/6f96919e74c0d3882b8651f58ce41a128a67630871118522cb73f1752898e57f

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6f96919e74c0d3882b8651f58ce41a128a67630871118522cb73f1752898e57f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6f96919e74c0d3882b8651f58ce41a128a67630871118522cb73f1752898e57f/

Neiki HEUR:Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

HEUR:Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/6f96919e74c0d3882b8651f58ce41a128a67630871118522cb73f1752898e57f

ReversingLabs TitaniumCloud Script-Shell.Downloader.Heuristic

Threat name:

Script-Shell.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-07-24 01:30:29 UTC

File Type:

Text (Shell)

AV detection:

8 of 36 (22.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n6ljdhtuydjyqk4gkh2yzza2ckfgoyyioeiykiwlopyxkkey4v7q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250724-cflllsel5s/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6f96919e74c0d3882b8651f58ce41a128a67630871118522cb73f1752898e57f