MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b792d74945ebf3d22828eaa22dec1d3df535247c6b741f003576e2be57195b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 4 File information Comments

SHA256 hash:	8b792d74945ebf3d22828eaa22dec1d3df535247c6b741f003576e2be57195b9
SHA3-384 hash:	c559856289f9b22f892b3ca1cdab296896652f4aa413a4d54818777587e5c176642af611fc3ac53a62cb40d05ff2858b
SHA1 hash:	6440e9244cd499dec25058d8662dec92a88230c3
MD5 hash:	c4ca0a47b8a54e1bffada4739a4fc5ec
humanhash:	twenty-jig-happy-oven
File name:	8b792d74945ebf3d22828eaa22dec1d3df535247c6b741f003576e2be57195b9
Download:	download sample
File size:	16'832 bytes
First seen:	2026-09-28 11:39:59 UTC
Last seen:	Never
File type:	php
MIME type:	text/x-php
ssdeep	384:jemvYrNNegege+eSWeaEy+871OYPmlQy4NU:jemwrNNegege+eSWm871Tm+fNU
TLSH	T15272942474C5677A427AEF786B82815CEA56030F4220CE28FDDE50887F7665783F1EE8
TrID	62.5% (.PHP) PHP source (5000/1) 37.5% (.HTML) HyperText Markup Language (3000/1/1)
Magika	php
Reporter	Anonymous
Tags:	php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac0b84659bf6e2f9e92c81b

Tags:

vmdetect virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm backdoor base64 cmd cmdkey evasive findstr fingerprint hacktool lolbin netsh obfuscated packed php powershell reconnaissance schtasks windows wmic

Link:

https://www.filescan.io/uploads/6aba52248e9b18b271d85f66/reports/864e2aef-28d8-4ae9-8c66-5c11f3321c10/overview

Verdict:

Suspicious

Labled as:

Agent.YM

Link:

https://www.hybrid-analysis.com/sample/8b792d74945ebf3d22828eaa22dec1d3df535247c6b741f003576e2be57195b9

Verdict:

Clean

File Type:

Link:

https://opentip.kaspersky.com/8b792d74945ebf3d22828eaa22dec1d3df535247c6b741f003576e2be57195b9/results?tab=lookup

Score:

32%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/8b792d74945ebf3d22828eaa22dec1d3df535247c6b741f003576e2be57195b9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8b792d74945ebf3d22828eaa22dec1d3df535247c6b741f003576e2be57195b9/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rn4s25eul27t2iucr2vcfxwb2ppvgushy23ud4adk5xcxzlrsw4q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/8b792d74945ebf3d22828eaa22dec1d3df535247c6b741f003576e2be57195b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	html_auto_download_b64 Create hunting rule
Author:	Tdawg
Description:	html auto download

Rule name:	SUSP_shellpop_Bash Create hunting rule
Author:	Tobias Michalski
Description:	Detects susupicious bash command
Reference:	https://github.com/0x00-0x00/ShellPop

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample