TF-1932744
high
📛 Threat Title
Unknown RAT: SHA256 hash of a malware sample (payload) e94a99395a2f5f33c84020f767151a2e464b1b32d7e323c949dbcee8577e4af2
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown RAT. Confidence: 75. First seen: 2026-09-25 09:05:30 UTC. Last seen: 2026-09-25 08:47:01 UTC. Reporter: emilstahl. Tags: ChainScript, etherhiding, NodeJS-RAT, Polygon.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
e94a99395a2f5f33c84020f767151a2e464b1b32d7e323c949dbcee8577e4af2
IOC database
- Type
- hash_sha256
- Value
e94a99395a2f5f33c84020f767151a2e464b1b32d7e323c949dbcee8577e4af2- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA256 hash of a malware sample (payload) attributed to Unknown RAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown RAT. Confidence: 75. First seen: 2026-09-25 09:05:30 UTC. Last seen: 2026-09-25 08:47:01 UTC. Reporter: emilstahl. Tags: ChainScript, etherhiding, NodeJS-RAT, Polygon.
Remediations (10)
-
web:bazaar.abuse.ch
Using the form below, you can search for malware samples by a hash (MD5, SHA256 , SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RAT .
-
web:boteraser.com
Unknown RAT is a remote access trojan first documented in May 2021 by Palo Alto Networks Unit 42 as a lightweight .NET‑based backdoor used by the…
-
web:cipherssecurity.com
What it does When you encounter an unknown executable, the fastest triage step is hash reputation: compute its cryptographic fingerprint and check threat-intel feeds for prior submissions. Our checker queries MalwareBazaar (abuse.ch's curated malicious- sample database) and VirusTotal, returning the aggregated verdict plus per-source details.
-
web:hash.cymru.com
Malware Hash Registry (MHR) This web form provides a manual interface for checking hashes against our malware data. Type in one or more hashes into the box below, then press "submit" to see if we recognize the hash as malicious.
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:ismalicious.com
Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.
-
web:ismalicious.com
File Hash Reputation MD5, SHA1, and SHA256 malware hash lookup Check a file hash before it becomes a manual investigation bottleneck. Enrich MD5, SHA1, and SHA256 indicators with reputation, malware context, related infrastructure, and API-ready evidence for SOC queues and incident response.
-
web:talosintelligence.com
Use Talos' File Reputation lookup to find the reputation, file name, weighted reputation score, and detection information available for a given SHA256 .
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with unknown_rat . You can also get this data through the ThreatFox API. Database Entry
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.