YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 020f6b3e045fa6b968226a8f2b2800dc55c65e842607d04d68b47ef4d18b0eee.

Scan Results


SHA256 hash: 020f6b3e045fa6b968226a8f2b2800dc55c65e842607d04d68b47ef4d18b0eee
File size:4'684'288 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 7e17c9e4ebe61e43966e9f65e334727e
SHA1 hash: 2172901d2a13304dd53a83e518fd5be84ed9ec08
SHA3-384 hash: 20403ee987a98978898b6ff85e9f23f5b64f6078037425ed7c43bc99e1358b86ab5ad4386ebe72282bdf467f7500c193
First seen:2022-09-03 17:13:32 UTC
Last seen:Never
Sightings:1
imphash : 9cbefe68f395e67356e2a5d8d1b285c0
ssdeep : 49152:cIwvquf3xrb/TivO90dL3BmAFd4A64nsfJMI3RKmegoBnPFs5ix2ooXwY9+xEk1N:03UyspSE5dEkxESJKC
TLSH : T100264B07F891C1A5C1AED130C665D293BA317C885B3023D36B61FBB92B76BD4AE79314
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:bca78e8f-2bab-11ed-a71a-42010aa4000b
File name:winnta.bin
Task parameters:ClamAV scan:True
Unpack:True
Share file:False

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:GoBinTest
TLP:TLP:WHITE
Repository:malware-bazaar
Rule name:golang
TLP:TLP:WHITE
Repository:malware-bazaar
Rule name:Golangmalware
Author:Dhanunjaya
Description:Malware in Golang
TLP:TLP:WHITE
Repository:malware-bazaar
Rule name:HiveRansomware
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
TLP:TLP:WHITE
Repository:malware-bazaar
Rule name:identity_golang
Author:Eric Yocam
Description:find Golang malware
TLP:TLP:WHITE
Repository:malware-bazaar
Rule name:methodology_golang_build_strings
Author:smiller
Description:Looks for PEs with a Golang build ID
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.