MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bce465c5cfd4c0bffef68fd4e89c25a1dc86b8793e2ea75b4264f045fdf265a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8bce465c5cfd4c0bffef68fd4e89c25a1dc86b8793e2ea75b4264f045fdf265a
SHA3-384 hash:	d0e30a9397c4f2b92e63e99f021f9bcc29e3f28dc7790d4ef5470adcfa682e1bdc5f40deeca3e94f9f47042d52b76500
SHA1 hash:	2867ea282a7fbf6383aee5564b751829792861d1
MD5 hash:	09261d97e3a316d071ba40f466196129
humanhash:	river-ten-sweet-charlie
File name:	right
Download:	download sample
Signature	KongTuke Alert Create hunting rule
File size:	5'476'222 bytes
First seen:	2026-03-17 16:07:21 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12288:TFwFhVsr02RC8Uy36VveV71o92w28uzkQ5qW1Dku6Fs:1
TLSH	T18246F69AF28817F88958ABCC434B399A53A282772EF7144996E1C15F7C2EF137530D78
Magika	powershell
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://flatheadcat[.]com/7s99.js --> hXXps://FlatheadCat[.]com/js.php (ClickFix) --> hXXps://obmlink[.]com/right (Powershell)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

6

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Win.Downloader.Emmenhtal-10044033-0

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ba554d93b644ca466b367a

Tags:

malware

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

unix shell

Link:

https://opentip.kaspersky.com/8bce465c5cfd4c0bffef68fd4e89c25a1dc86b8793e2ea75b4264f045fdf265a/results?tab=lookup

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8bce465c5cfd4c0bffef68fd4e89c25a1dc86b8793e2ea75b4264f045fdf265a

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Boxter

Threat name:

Script-PowerShell.Trojan.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-18 07:33:38 UTC

File Type:

Text

AV detection:

3 of 36 (8.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rphemxc47vgax77pnd6u5coclio4q24hsprou5nuezhqix67ezna._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.