YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 1d60903c4cf77503ae2ccbc0e1f33e455033bca93d1a289531df7e1a166a5449.

Scan Results

SHA256 hash:	1d60903c4cf77503ae2ccbc0e1f33e455033bca93d1a289531df7e1a166a5449
File size:	3'987'824 bytes
File download:	Original Unpacked
MIME type:	application/x-dosexec
MD5 hash:	48d66a8f0f2a7d144cfa1f6b7a006c69
SHA1 hash:	b267d67a00e870fe7f6b2b595842231ddace2657
SHA3-384 hash:	12db7df9a35c90b1937abbfa7aa63b4a205848629aa62d0cea6d0b7b07b3321289da25f5cf94ffcf3bd98057304ab656
First seen:	2026-08-10 06:56:03 UTC
Last seen:	2026-08-10 09:53:32 UTC
Sightings:	2
imphash :	d42595b695fc008ef2c56aabd8efd68e Create hunting rule
ssdeep :	49152:PzAYhHUjjTzdu7fjboLmZuJ+OTjtI5nSBPfC01/xPdJuL1Yz3M:Pz3bjjboLmZuJ6pP6aqz3M
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	589fea95-94a1-11f1-bf07-42010aa4000b
File name:	1d60903c4cf77503ae2ccbc0e1f33e455033bca93d1a289531df7e1a166a5449.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

No matches

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Author:	classified
Description:	classified

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	GoBinTest Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang_duffcopy_amd64 Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	classified

Rule name:	classified

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits
TLP:	TLP:WHITE
Repository:

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language
TLP:	TLP:WHITE
Repository:

Rule name:	RemusStealer_GoPayload Create hunting rule
Author:	burger
Description:	Detects RemusStealer Go-compiled payload
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants
TLP:	TLP:WHITE
Repository:

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

Task Information

Task ID:	8ddfdb07-9488-11f1-bf07-42010aa4000b
File name:	48d66a8f0f2a7d144cfa1f6b7a006c69
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

No matches

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Author:	classified
Description:	classified

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	GoBinTest Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang_duffcopy_amd64 Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	classified

Rule name:	classified

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits
TLP:	TLP:WHITE
Repository:

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language
TLP:	TLP:WHITE
Repository:

Rule name:	RemusStealer_GoPayload Create hunting rule
Author:	burger
Description:	Detects RemusStealer Go-compiled payload
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants
TLP:	TLP:WHITE
Repository:

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

YARAify Scan Results

Scan Results Rescan

Tasks

2026-08-10 09:53:32 UTC Static: 25 Unpacker: 0 ClamAV: 0

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2026-08-10 06:56:04 UTC Static: 25 Unpacker: 0 ClamAV: 0

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

Scan Results