YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 18b57f36ece48c37c0e3c0334fa8b0027b0c9c0fabea5bfc9be0f4bcc1d0df7c.

Scan Results

SHA256 hash: 18b57f36ece48c37c0e3c0334fa8b0027b0c9c0fabea5bfc9be0f4bcc1d0df7c
File size:37'244'928 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 8c64dad1516f110dda3a511063570ee7
SHA1 hash: 847b0ba8e3a5a50ef0744821b2338e13d857cb14
SHA3-384 hash: c4729743da68e22d0a15c66374a894818094f75054f50b601019daec8644e59ac1bbf0aa7e23e44aa88dcea859578260
First seen:2026-03-27 11:08:24 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 393216:vr4C9Z+T3CFF0EHkQy8gGTOr/wRyIEORIo7dAaQwfeOFLILtVWDzngSCVpl:v8CW5zIHWOhdvnCV
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 489669d8d8699648
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:4634ea12-29cd-11f1-b47f-42010aa4000b
File name:1030000.0b679027e38f3d9ca554085be0e762c651e83e6414401.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Agent_BTZ
Create hunting rule
TLP:TLP:WHITE
Repository:Intezer
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER
Rule name:Anydesk
Create hunting rule
Author:CD_R0M_
Description:Anydesk is commonly used by threat actors for remote access. This rule aims to identify legitimate anydesk, renamed binaries and trojanized versions.
Reference:https://www.crowdstrike.com/blog/falcon-complete-disrupts-malvertising-campaign-targeting-anydesk/
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:classified
Author:classified
Description:classified
TLP :TLP:GREEN
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:TLP:WHITE
Repository:YARAify
Rule name:dl_shadow
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
TLP:TLP:WHITE
Repository:
Rule name:MoleBoxv20
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:pe_no_import_table
Create hunting rule
Author:
Description:Detect pe file that no import table
TLP:TLP:WHITE
Repository:YARAify
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
TLP:TLP:WHITE
Repository:
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
TLP:TLP:WHITE
Repository:
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
TLP:TLP:WHITE
Repository:
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
TLP:TLP:WHITE
Repository:YARAify
Rule name:Sus_AnyDesk_Attempts_Feb2024
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
TLP:TLP:WHITE
Repository:YARAify
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
TLP:TLP:WHITE
Repository:YARAify
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
TLP:TLP:WHITE
Repository:YARAify
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
TLP:TLP:WHITE
Repository:YARAify
Rule name:TH_APT_EquationGroup_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Equation Group (G0020) APT malware detection - covers EquationDrug, GrayFish, DoubleFantasy, TripleFantasy, Fanny, GROK, nls_933w HDD firmware module, and Shadow Brokers tooling
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.