MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65
SHA3-384 hash: a0338c6cf6623c40b875d59658a1968eb3475ba8a91bab7ddf68a8b6b8a91f64963a0eda6ea416e91a1fd97c908606cc
SHA1 hash: 37482e878b52df92747b8868ef177f92994709bc
MD5 hash: b52c0f9768c521b9c9e5929d69acba1b
humanhash: sweet-west-carpet-purple
File name:create.py
Download: download sample
File size:5'068 bytes
First seen:2025-12-13 07:50:09 UTC
Last seen:Never
File type:
MIME type:text/plain
ssdeep 96:UIuUdbUeo0eweaGe4eecemeI8FUNFNNFOF0FeFtF09ioIi8iaKiUiegiqiIToSuL:UWfKnaV/s1I8FWFDFOF0FeFtF09iji8K
TLSH T132A1279EF5B173730DACDD16F2168A2AF042828602225F6976E970F8BDFBD499D40315
Magika csv
Reporter abuse_ch
Tags:py

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693d1ac5bde6a3e597110962
Tags:
n/a
Verdict:
Malicious
Labled as:
Trojan/BAT.Obfuscated.aar
Link:
https://www.hybrid-analysis.com/sample/cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65
Verdict:
Malicious
File Type:
text
First seen:
2025-12-13T04:58:00Z UTC
Last seen:
2025-12-14T12:01:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-13 07:39:18 UTC
File Type:
Text (Shell)
AV detection:
15 of 38 (39.47%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zsu4fn4z463q5uqddtrs26zhvxpvzr6w7mmh6lbjosd4cusf3vsq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251213-jpja6sxrg1/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3732788/
  
Delivery method
Distributed via web download

Comments