YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 0918f055398bf975bdaec4777fa06d10b1db7cb8a42e230b20dc4bf0d6eecd97.

Scan Results

SHA256 hash:	0918f055398bf975bdaec4777fa06d10b1db7cb8a42e230b20dc4bf0d6eecd97
File size:	229'288 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	4ff158a6f293f2ab0292f930520286e7
SHA1 hash:	f4bd57412bf69fe1b821274e2e54cdd4c5d43d02
SHA3-384 hash:	e57155e39012bf53a31271255ecb4719a8d23abd17afb653b63c4490bda74625c57359c879103bbe09159bd14abd4b44
First seen:	2026-09-09 02:34:24 UTC
Last seen:	Never
Sightings:	1
imphash :	f34d5f2d4577ed6d9ceec516c1f5a744 Create hunting rule
ssdeep :	6144:MLV6Bta6dtJmakIM5Y8GL+1WUQ52F+/8Ej4eguC:MLV6BtpmkgGLUcQsEEj4A
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	f8a1cd19-abf6-11f1-b69f-42010aa4000b
File name:	447058.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Dropper.Nancrat-9869495-0 Create hunting rule

Signature:	Win.Dropper.Nanocore-9916514-0 Create hunting rule

Signature:	Win.Packed.Generic-9777790-0 Create hunting rule

Signature:	Win.Trojan.Generic-9783914-0 Create hunting rule

Signature:	Win.Trojan.Nanocore-5 Create hunting rule

Signature:	Win.Trojan.NanoCore-9852758-0 Create hunting rule

Signature:	YARA.DITEKSHEN_MALWARE_Win_Nanocore.UNOFFICIAL Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	malware_Nanocore_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MALWARE_Win_NanoCore Create hunting rule
Author:	ditekSHen
Description:	Detects NanoCore
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	nanocore_rat Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore_RAT_Feb18_1_RID2DF1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T
TLP:	TLP:WHITE

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore_RAT_Gen_2_RID2D96 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:	TLP:WHITE

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	pe_imphash Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	win_nanocore_w0 Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	Windows_Trojan_Nanocore_d8c4e3c5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.