YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 2801ccd00ad4c93afcc23b9f8e5f56a8ddef81c1f4b331978d9b288a69f8ce4d.
Scan Results
| SHA256 hash: | 2801ccd00ad4c93afcc23b9f8e5f56a8ddef81c1f4b331978d9b288a69f8ce4d | |
|---|---|---|
| File size: | 1'120'257 bytes | |
| File download: | Original | |
| MIME type: | text/plain | |
| MD5 hash: | 9505a1d9114cda476f0a0e4614e7cbb1 | |
| SHA1 hash: | 825586012df0b9c84aab2b528c883a603c0ba252 | |
| SHA3-384 hash: | 138bcf0710b4b2194c078660404b1c9cb8856d818f32df4707eddf7114c52e57de33528077a4d1581ccd442c264f5c50 | |
| First seen: | 2026-04-07 09:24:29 UTC | |
| Last seen: | 2026-04-07 09:26:11 UTC | |
| Sightings: | 2 | |
| imphash : | n/a | |
| ssdeep : | 24576:D4X1o6DS+35fKxZHbP01d1xO3HLJsEuGPuXM2nHA:0dKGc3l5eHA | |
| TLSH : | n/a | |
| telfhash : | n/a | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | d11a0a3e-3263-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | 9505a1d9114cda476f0a0e4614e7cbb1 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | telebot_framework |
|---|---|
| Author: | vietdx.mb |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter
Task Information
| Task ID: | 94726dd4-3263-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | 2801ccd00ad4c93afcc23b9f8e5f56a8ddef81c1f4b331978d9b288a69f8ce4d.ps1 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | telebot_framework |
|---|---|
| Author: | vietdx.mb |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter