YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 07f1159223c8e31f487c31a4ab7159c22396fa350a885f735355945a068c5901.

Scan Results

SHA256 hash: 07f1159223c8e31f487c31a4ab7159c22396fa350a885f735355945a068c5901
File size:14'157'312 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 1373667ba0dd7f7b7a5027ed99321a82
SHA1 hash: 3ad5450dd49517822acea886da568e80afb7c2a2
SHA3-384 hash: b38cc6447b6a6716ab91dc006fa86202f8750e84b4a44426fdf49fe4d456c2da90f102383b3dec3d3b7004201606ebd2
First seen:2025-11-21 02:56:12 UTC
Last seen:Never
Sightings:1
imphash : 216fd5a1a63d6c7b867c85215f9f4050
Create hunting rule
ssdeep : 393216:TM8igZi7slSEbL5lvmgOC5Nq67nfjOrFpvB2Xa6dPtq:g8bMnEbNpmqF7nfj67vBua6dPtq
TLSH : T1A3E633670756852AC2A08E7C52B6EF7431F71FA15429846AE0F67CE3BA33ED42D43C52
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon : 630c8d8c0d073e0c
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:a3aafd22-c685-11f0-adeb-42010aa4000b
File name:1373667ba0dd7f7b7a5027ed99321a82
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.