MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411
SHA3-384 hash:	dfc366f7f4f75fd52d9e13dccc2671400a715f6d899f4fd032f333a889a7c47a72da25bb2ed1be7ce9c6de4c2e399ffd
SHA1 hash:	32ebff75e5cda98c9ea78db26de4f09aec185c4a
MD5 hash:	25c093e39a9d4e8e34ac2108134b82de
humanhash:	november-minnesota-sad-sixteen
File name:	d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411
Download:	download sample
File size:	659'456 bytes
First seen:	2026-07-16 15:30:15 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	12288:yR7o/CAJwZGBQ5CqOBHaZBw5VD1OgyKC2vbQl+b4IE+Bo2rtStux:ypo/CeHSUqO9KByVJRNj6+bjE+B+c
TLSH	T193E423C4DDF94B33A6E9F016FB2E86A164E217E124BB0BD4B3A79EB3B42D0D90150475
Magika	gzip
Reporter	EnthecSolutions
Tags:	enthec gz

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

CA

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411~
File size:	762'956 bytes
SHA256 hash:	f41426f11dbdbf9ea06b6f5846035a25c0d5e070f25aeafae41234b4d25d410b
MD5 hash:	7dbd55ba07ed93c58c921ccfc59be3e9
MIME type:	application/x-tar

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Python.Agent-BN.17669.869.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Python.Agent-BN.13321.10513.UNOFFICIAL

Alert

Create hunting rule

YARA.SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a10964433e785de369cda5d

Tags:

malware

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

gz

First seen:

2026-07-16T13:17:00Z UTC

Last seen:

2026-07-16T13:29:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

GZip Archive

Link:

https://app.malva.re/file/25c093e39a9d4e8e34ac2108134b82de

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411/

ReversingLabs TitaniumCloud Linux.Trojan.Ravartar

Threat name:

Linux.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-16 15:30:43 UTC

File Type:

Binary (Archive)

Extracted files:

10

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3f56qfwblk76onwbrbcm7pdqwm6ou2ojj7lwon4m7lpbzgrsyqiq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411