YARAify Scan Results

Task Information

---

Task ID:	bca78e8f-2bab-11ed-a71a-42010aa4000b
File name:	winnta.bin
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	False

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	command_and_control Alert Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	GoBinTest Alert Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang Alert Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Golangmalware Alert Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	HiveRansomware Alert Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	identity_golang Alert Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	methodology_golang_build_strings Alert Create hunting rule
Author:	smiller
Description:	Looks for PEs with a Golang build ID
TLP:	TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.