YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 26793c538d87b072ebcc0fba95295204075cff52a75442bb408d8ffae3a4c306.

SHA256 hash:	26793c538d87b072ebcc0fba95295204075cff52a75442bb408d8ffae3a4c306
File size:	27'042 bytes
File download:	Original
MIME type:	text/x-shellscript
MD5 hash:	37ad2bdfc95fc47c95acf48ffbea08b8
SHA1 hash:	bd622b329ee3ed7db69cd31641d1d07f48c52da4
SHA3-384 hash:	65a4b831e65b4a940fab06b3fcf62d9d8572683bf93c49e90dae10dc4ef965097dae92ceeab8e2de521cfef41fcc2931
First seen:	2026-09-19 11:11:17 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	768:W8vCB+25j6es8RJI9FYpMSUpi+20qUpi+20YQX:W8l25J4d2QX
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task ID:	d5a3ec6c-b41a-11f1-a0cd-42010aa4000b
File name:	26793c538d87b072ebcc0fba95295204075cff52a75442bb408d8ffae3a4c306.sh
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	JOMANGYStager_2ndStage Create hunting rule
Author:	abuse.ch
Description:	Detects JOMANGYStager Bash Script
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_LNX_Base64_Exec_Apr24 Create hunting rule
Author:	Christian Burkard
Description:	Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:	Internal Research
TLP:	TLP:WHITE

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-09-19 11:11:17 UTC Static: 3 Unpacker: 0 ClamAV: 0