SHA256MediumSignal 67/100
25e4b2c4bb37f125b693a9c57b0e743eab2a3d98234f7519cd389e788252fd13
First Seen
Apr 17, 2026
Last Seen
May 29, 2026
Found in 4 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
67%
Signal Score
67 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Feed Intelligence Summary
4 reports67% confidence
4
Source reports
67%
Confidence score
Category tags
active scanagentattackbackbad reputationbashcloudcontactdemodetect-debug-environmentdevtcpipportenumerateexecutable fileexploitation activityfile-hashgrephuntindicatoripv4kagentlong-sleepsmacosmalwaremarimonkabusenkn blockchainpostgresqlpythonrebootresearchedreverse shellscriptselectshellspacesstrongsuspsysdigt1016t1021.004t1027.002t1033t1053t1053.003t1059.004t1059.006t1071.004t1082t1083t1090t1095t1105t1140t1190t1543.001t1543.002t1552.001t1571t1573.002targetvulnerability scan
Activity Timeline
May 29May 29
Threat Activity Heatmap
· Peak: 2026-05-29LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreMedium Risk
67
SIGNAL
Signal Score
67%
Confidence
4
Reports
First seenApr 17, 2026
Last seenMay 29, 2026
VirusTotal
Not checked
WHOIS
- description
- Bourne-Again shell script, ASCII text executable
- references
- https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface, IOCs.2026.csv, https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface#conclusion
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 2 months ago · Last seen 1 month ago
Appeared in 4 threat reports