YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 180b959eaecaa6c410af4f4445befcde5947a537ec396196fda014258625e2dd.

Scan Results

SHA256 hash: 180b959eaecaa6c410af4f4445befcde5947a537ec396196fda014258625e2dd
File size:9'105'408 bytes
File download: Original
MIME type:application/x-msi
MD5 hash: 92141b1d875854e40a97ace4da54c60f
SHA1 hash: c6e87e54ec01dbf9f326e908c7ce3136b9cc6f00
SHA3-384 hash: 9ac53ffc355bb9d2093f5ac8cf8975b4de9e655674a838e01ee80f8669cbfd78c9267d6016b25ae90c5994e9d8ba9caf
First seen:2026-03-11 15:30:46 UTC
Last seen:2026-03-11 15:34:03 UTC
Sightings:2
imphash :n/a
ssdeep : 196608:OmVT1P0ZO10P53/vmVT1P0ZO10imVT1P0ZO109mVT1P0ZO10xmVT1P0ZO10:dVT1sZ/P53/OVT1sZ/BVT1sZ/AVT1sZT
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:bb876d35-1d5f-11f1-b47f-42010aa4000b
File name:92141b1d875854e40a97ace4da54c60f
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:TLP:WHITE
Repository:YARAify
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.

Task Information

Task ID:46582e96-1d5f-11f1-b47f-42010aa4000b
File name:180b959eaecaa6c410af4f4445befcde5947a537ec396196fda014258625e2dd.msi
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:TLP:WHITE
Repository:YARAify
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.