TF-1932743
high
📛 Threat Title
Unknown RAT: SHA256 hash of a malware sample (payload) 086f5e17a9d3a30460f3f8ff95613ef7c5b479831ff5163015b2b7ea42cd3679
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown RAT. Confidence: 75. First seen: 2026-09-25 09:05:29 UTC. Last seen: 2026-09-25 08:47:01 UTC. Reporter: emilstahl. Tags: ChainScript, etherhiding, NodeJS-RAT, Polygon.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
086f5e17a9d3a30460f3f8ff95613ef7c5b479831ff5163015b2b7ea42cd3679
IOC database
- Type
- hash_sha256
- Value
086f5e17a9d3a30460f3f8ff95613ef7c5b479831ff5163015b2b7ea42cd3679- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA256 hash of a malware sample (payload) attributed to Unknown RAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown RAT. Confidence: 75. First seen: 2026-09-25 09:05:29 UTC. Last seen: 2026-09-25 08:47:01 UTC. Reporter: emilstahl. Tags: ChainScript, etherhiding, NodeJS-RAT, Polygon.
Remediations (10)
-
web:bazaar.abuse.ch
Using the form below, you can search for malware samples by a hash (MD5, SHA256 , SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RAT .
-
web:boteraser.com
Unknown RAT is a remote access trojan first documented in May 2021 by Palo Alto Networks Unit 42 as a lightweight .NET‑based backdoor used by the…
-
web:cipherssecurity.com
Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:ismalicious.com
Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.
-
web:ismalicious.com
File Hash Reputation MD5, SHA1, and SHA256 malware hash lookup Check a file hash before it becomes a manual investigation bottleneck. Enrich MD5, SHA1, and SHA256 indicators with reputation, malware context, related infrastructure, and API-ready evidence for SOC queues and incident response.
-
web:talosintelligence.com
Use Talos' File Reputation lookup to find the reputation, file name, weighted reputation score, and detection information available for a given SHA256 .
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with unknown_rat . You can also get this data through the ThreatFox API. Database Entry
-
web:www.hashzyn.com
HashZyn is an online malware scanner and API. It computes SHA-256 hashes in your browser, scans unknown files and URLs against commercial engines and threat feeds, and returns a single verdict: clean, suspicious, or malicious.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.