Forensia: Free Threat Intelligence Lookup

FORENSIA

Indicator investigation

warming up…

Resolving indicator evidenceacquiring

Loading verdict, provenance, relationships and sightings.

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Verdict

KNOWN MALWARE — Muddywater

What is this: Malware file — Muddywater.
Should you care: Yes — Muddywater is known-malicious, attributed by name.
What to do: Isolate and reimage any host with this file. Block the hash.

INVESTIGATEMODERATE EVIDENCE COVERAGEDeterministic · stored evidence only

Malware file investigation

MuddyWater malware sample

MalwareBazaar reported this EXE sample as confirmed malware. MuddyWater is the stored family attribution. 1 distinct source and 2 verified alternate digests are available. The hash identifies file bytes; it does not prove the file executed in any environment.

File classification

Confirmed malware sample

Classification is bounded to named stored sources.

Malware family

MuddyWater

A source-provided label, not a Forensia-inferred attribution.

File profile

SHA-1 · EXE

No bounded behavior category is available from stored tags.

Source corroboration

1 distinct connector

1 polling citation is shown separately and not treated as independent evidence.

Related evidence

2 same-file digest variants

Only persisted same-file edges, YARA matches, and exact report mentions count here; generic file-type co-tags are excluded.

Observation window

2026-03-02 → 2026-03-02

These are first and last local feed observations, not file creation or execution times.

What the evidence supports

Findings stay bounded to named sources and observable infrastructure.

2 findings

Source confirms a malware sample

HIGH

The digest appears in MalwareBazaar, whose submission policy accepts vetted malware samples rather than suspicious or benign uploads.

MalwareBazaar feed · 1 distinct local connector

The classification applies to this exact byte sequence; repacked or modified variants have different hashes.

Verified same-file digest variants

HIGH

SHA-256 24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14, MD5 439c0a0a46627bd166e08436f383ad56

Persisted related_hash edges from the ingestion record

These hashes identify the same reported file, not a broader malware campaign or operator.

What remains unknown

No stored YARA match or sandbox behavior trace describes what the file does at runtime.
No locally ingested report provides delivery chain, victimology, actor, or campaign context for this exact hash.
No source-backed ATT&CK technique mapping is attached to this file.
Current prevalence, execution in your environment, and whether the sample is still distributed are not established by a hash lookup.
Command-and-control infrastructure is not asserted unless an exact report or persisted relationship supplies it.

Graph preview

Neighborhood topology. Open the graph for interactive pivots.

Open full investigation canvas →

Building relationship previewacquiring

Loading connected indicators, reports and entities.

Continue investigation

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open in graph
Full investigation canvas with neighbor expansion.