YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 0cdabc4aeb142f7e701d0d1ecaafe555c3b1243706517565e5b7d3369509349f.

Scan Results

SHA256 hash: 0cdabc4aeb142f7e701d0d1ecaafe555c3b1243706517565e5b7d3369509349f
File size:2'387'968 bytes
File download: Original
MIME type:application/octet-stream
MD5 hash: c8387c2d1d8d8a5ef0ca854f3587e6fb
SHA1 hash: 99fceae291c10f8f8a0ebef3db0c3e03d8b3fa27
SHA3-384 hash: 298a736ab7b5a37e6aee7139c47ae3da225bc375c559ad5d6aba75c3ec1b6313453f3eeffae73cc963aa581e4fdd5d92
First seen:2022-11-24 19:43:07 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 12288:5qliYPqPazsOJosOiwQV/7WGJBzsOXaMV2Ac92:4lpOaI2oM7V1JBIOaMV2Ac92
TLSH : T1DBB5AC80E7F987AEF2F37EF806B59791D936BC62A931C3089954255E29B1D804C70F27
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:387a15a7-6c30-11ed-a71a-42010aa4000b
File name:4390000.shc
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
TLP:TLP:WHITE
Repository:jeFF0Falltrades
Rule name:nanocore_surveillance_plugin
Create hunting rule
Author:jeFF0Falltrades
TLP:TLP:WHITE
Repository:jeFF0Falltrades
Rule name:Windows_Trojan_Nanocore_d8c4e3c5
Create hunting rule
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.