MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce01dac06be173ddfe6f1e1d65088a112272a2d158b7da505fc23f014e7ca63a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ce01dac06be173ddfe6f1e1d65088a112272a2d158b7da505fc23f014e7ca63a
SHA3-384 hash:	4d9bf4625711a58c4a3e206dd2e58f469e0c44322e1b3fbaed97008bc9166fad9cf127f81cad81c782842f5731a24d86
SHA1 hash:	db13f506c06863b77ddcf7198f0fa07c71ab166e
MD5 hash:	406e903f12cb490431db07ec65e153ac
humanhash:	washington-indigo-fish-august
File name:	kj.txt
Download:	download sample
File size:	41'461 bytes
First seen:	2026-09-25 03:14:17 UTC
Last seen:	Never
File type:	php
MIME type:	text/x-php
ssdeep	768:AaytylUsoBwrTwJ98ji1l6UlE4zpJovYhCWVR44tQx9aTp/:3OylgBeji1lzl1yE29yp/
TLSH	T1CE132B21B1829C126107CABA77C3650D3669436F83024E88FD9D5AF5EFC45F4867AEE8
TrID	62.5% (.PHP) PHP source (5000/1) 37.5% (.HTML) HyperText Markup Language (3000/1/1)
Magika	php
Reporter	boredchilada2
Tags:	cpanel kamp4ng php php-webshell team-kj

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

63

Origin country :

CA

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

backdoor masquerade obfuscated php

Link:

https://www.filescan.io/uploads/6ab5e74caf8127af5e6b2676/reports/9ca687f7-8051-4569-8daa-a3551e71220f/overview

Hybrid Analysis Backdoor/PHP.WebShell

Verdict:

Suspicious

Labled as:

Backdoor/PHP.WebShell

Link:

https://www.hybrid-analysis.com/sample/ce01dac06be173ddfe6f1e1d65088a112272a2d158b7da505fc23f014e7ca63a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-25T01:05:00Z UTC

Last seen:

2026-09-26T22:07:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ce01dac06be173ddfe6f1e1d65088a112272a2d158b7da505fc23f014e7ca63a/results?tab=lookup

Nucleon Malprob Benign

Score:

6%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/ce01dac06be173ddfe6f1e1d65088a112272a2d158b7da505fc23f014e7ca63a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce01dac06be173ddfe6f1e1d65088a112272a2d158b7da505fc23f014e7ca63a/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-25 03:15:21 UTC

File Type:

Text (PHP)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zya5vqdl4fz537tpdyowkcekcerhfiwrlc35uuc7yi7qctt4uy5a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ce01dac06be173ddfe6f1e1d65088a112272a2d158b7da505fc23f014e7ca63a