TF-1932745 high

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown RAT. Confidence: 75. First seen: 2026-09-25 09:05:28 UTC. Last seen: 2026-09-25 08:47:01 UTC. Reporter: emilstahl. Tags: ChainScript, etherhiding, NodeJS-RAT, Polygon.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown RAT. Confidence: 75. First seen: 2026-09-25 09:05:28 UTC. Last seen: 2026-09-25 08:47:01 UTC. Reporter: emilstahl. Tags: ChainScript, etherhiding, NodeJS-RAT, Polygon.

• MalwareBazaar | Browse malware samples - abuse.ch
  web:bazaar.abuse.ch

  Using the form below, you can search for malware samples by a hash (MD5, SHA256 , SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database

  2026-09-25 15:06 UTC
• MalwareBazaar | RAT - abuse.ch
  web:bazaar.abuse.ch

  A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RAT .

  2026-09-25 15:06 UTC
• Unknown RAT — Malware Profile & Detection | BotEraser
  web:boteraser.com

  Unknown RAT is a remote access trojan first documented in May 2021 by Palo Alto Networks Unit 42 as a lightweight .NET‑based backdoor used by the…

  2026-09-25 15:06 UTC
• Hash Reputation Checker — MD5/SHA-256 Malware Lookup
  web:cipherssecurity.com

  What it does When you encounter an unknown executable, the fastest triage step is hash reputation: compute its cryptographic fingerprint and check threat-intel feeds for prior submissions. Our checker queries MalwareBazaar (abuse.ch's curated malicious- sample database) and VirusTotal, returning the aggregated verdict plus per-source details.

  2026-09-25 15:06 UTC
• GitHub - LGOG/Flagged_Hash_list: This is a list of known malicious ...
  web:github.com

  The Flagged Hash .csv file is a meticulously curated collection of file hashes (MD5, SHA-1, SHA-256 , etc.) associated with malware , ransomware, and other cyber threats. This list consolidates information from reputable cybersecurity sources, ensuring a comprehensive tool for identifying and neutralizing potential threats.

  2026-09-25 15:06 UTC
• Hash Checker - File & Malware Hash Lookup | InventiveHQ
  web:inventivehq.com

  Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.

  2026-09-25 15:06 UTC
• Malware Hashes - File Hash Intelligence | isMalicious
  web:ismalicious.com

  Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.

  2026-09-25 15:06 UTC
• File Hash Check: Is This SHA-256 Malware? | isMalicious Blog
  web:ismalicious.com

  How to check MD5, SHA-1, and SHA-256 hashes against threat intelligence, and how SOC teams use hash reputation to cut false positives.

  2026-09-25 15:06 UTC
• Talos File Reputation Lookup || Cisco Talos Intelligence Group ...
  web:talosintelligence.com

  Use Talos' File Reputation lookup to find the reputation, file name, weighted reputation score, and detection information available for a given SHA256 .

  2026-09-25 15:06 UTC
• ThreatFox | Unknown RAT
  web:threatfox.abuse.ch

  ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with unknown_rat . You can also get this data through the ThreatFox API. Database Entry

  2026-09-25 15:06 UTC

Only Available for Registered Users. Sign in to view.