YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 0caacc324e93026344068c2d7ea168c5b87b58640e98cb1f657230a8436d9765.

Scan Results

SHA256 hash:	0caacc324e93026344068c2d7ea168c5b87b58640e98cb1f657230a8436d9765
File size:	207'872 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	03d284b954a876fda61c64a176f1e8b7
SHA1 hash:	0b9a3cb4736c9f10e240fd8927d55ef353bd0cea
SHA3-384 hash:	d2d995672d8e20b7ff40bc51b55892aaeeb6cf4bc90696798c5c0b73542090c2c118555db365adbc7486ce7698e9aa6b
First seen:	2026-03-14 19:48:58 UTC
Last seen:	2026-03-14 22:45:29 UTC
Sightings:	2
imphash :	f34d5f2d4577ed6d9ceec516c1f5a744 Create hunting rule
ssdeep :	6144:MLV6Bta6dtJmakIM5chPXJM+YjP3V659eb:MLV6BtpmkphFKFm+
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	805e8615-1ff7-11f1-b47f-42010aa4000b
File name:	0caacc324e93026344068c2d7ea168c5b87b58640e98cb1f657230a8436d9765.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Dropper.Nancrat-9869495-0 Create hunting rule

Signature:	Win.Dropper.Nanocore-9916514-0 Create hunting rule

Signature:	Win.Packed.Generic-9777790-0 Create hunting rule

Signature:	Win.Trojan.Generic-9783914-0 Create hunting rule

Signature:	Win.Trojan.Nanocore-5 Create hunting rule

Signature:	Win.Trojan.NanoCore-9852758-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	malware_Nanocore_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MALWARE_Win_NanoCore Create hunting rule
Author:	ditekSHen
Description:	Detects NanoCore
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	nanocore_rat Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore_RAT_Feb18_1_RID2DF1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T
TLP:	TLP:WHITE

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore_RAT_Gen_2_RID2D96 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:	TLP:WHITE

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	pe_imphash Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	win_nanocore_w0 Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	Windows_Trojan_Nanocore_d8c4e3c5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

Task Information

Task ID:	d7c2c9ba-1fde-11f1-b47f-42010aa4000b
File name:	03d284b954a876fda61c64a176f1e8b7
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Dropper.Nancrat-9869495-0 Create hunting rule

Signature:	Win.Dropper.Nanocore-9916514-0 Create hunting rule

Signature:	Win.Packed.Generic-9777790-0 Create hunting rule

Signature:	Win.Trojan.Generic-9783914-0 Create hunting rule

Signature:	Win.Trojan.Nanocore-5 Create hunting rule

Signature:	Win.Trojan.NanoCore-9852758-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	malware_Nanocore_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MALWARE_Win_NanoCore Create hunting rule
Author:	ditekSHen
Description:	Detects NanoCore
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	nanocore_rat Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore_RAT_Feb18_1_RID2DF1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T
TLP:	TLP:WHITE

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore_RAT_Gen_2_RID2D96 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:	TLP:WHITE

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	pe_imphash Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	win_nanocore_w0 Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	Windows_Trojan_Nanocore_d8c4e3c5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

YARAify Scan Results

Scan Results Rescan

Tasks

2026-03-14 22:45:29 UTC Static: 15 Unpacker: 0 ClamAV: 6

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2026-03-14 19:48:58 UTC Static: 15 Unpacker: 0 ClamAV: 6

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

Scan Results