YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 2167ca7f281ac844b21a79863694416725998a6364b96d54d30f0587ab5f33f8.

Scan Results

SHA256 hash: 2167ca7f281ac844b21a79863694416725998a6364b96d54d30f0587ab5f33f8
File size:7'168 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 17bdfda0bd95d380e956b52c424379be
SHA1 hash: ea8409d83747d6e621facee2cbc300b273252d55
SHA3-384 hash: 01ffc9a7138858bb182d0bc670e12285c0e4206176467c3c8c4d9c5906616d2e13fc98254653c6d369453bab32fa27f3
First seen:2026-03-25 16:20:08 UTC
Last seen:Never
Sightings:1
imphash : c2d02fc98f1d75d7b9457468ec75da0e
Create hunting rule
ssdeep : 24:eFGSG9wSyUIcMdMy58XZh9h9ClfAhJTIAJW4up+:iG+HxwyeXZh9hMluJTJW4b
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:7db3cff2-2866-11f1-b47f-42010aa4000b
File name:17bdfda0bd95d380e956b52c424379be
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.Inject6.5094.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CobaltStrike__Resources_Reverse_Bin_v2_5_through_v4_x
Create hunting rule
Author:gssincla@google.com
TLP:TLP:WHITE
Repository:GCTI
Rule name:CobaltStrike_Resources_Reverse_Bin_v2_5_through_v4_x
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:metasploit_rev_tcp_32
Create hunting rule
Author:Javier Rascon
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify
Rule name:classified
Description:classified
Rule name:Rozena
Create hunting rule
TLP:TLP:WHITE
Repository:CAPE
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify
Rule name:Windows_Trojan_Metasploit_0cc81460
Create hunting rule
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic
Rule name:Windows_Trojan_Metasploit_4a1c4da8
Create hunting rule
Author:Elastic Security
Description:Identifies Metasploit 64 bit reverse tcp shellcode.
TLP:TLP:WHITE
Repository:elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.