YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 20c6fff84cfd072b08365635beba9d165f5543e75191b141bd508de5afb0c786.

Scan Results

SHA256 hash: 20c6fff84cfd072b08365635beba9d165f5543e75191b141bd508de5afb0c786
File size:786'432 bytes
File download: Original
MIME type:application/octet-stream
MD5 hash: 5ef082ec59d255b03daf02066872bdd4
SHA1 hash: fb278c56beb07644010cd3bfa41c1a1ca9798c31
SHA3-384 hash: aedfad0bb8d0ebae54fbbc209ebd201b8e8a730bcc5e95d8111e64fdd8871be2d2b73ed793c7fdd2c40b5ae767c29b22
First seen:2025-11-20 07:03:00 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 6144:SwxEt/+LWhtwqv3mxJvAYr1TsQnYOVzYKiRtJHo+ojqGa02jq7V:GtHqxD1Ts409I+ojNabjcV
TLSH : T196F4D66377D54225E2FE5E3688FA457BFA39BC06AE02C70F608467BE0C3179C9961B05
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:f3b55df5-c5de-11f0-adeb-42010aa4000b
File name:2540000.shc
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.