YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 30e5dcdb90806671247881b64d35090c94b2fa9d4f131ab416c02b7d09b93860.

Scan Results

SHA256 hash: 30e5dcdb90806671247881b64d35090c94b2fa9d4f131ab416c02b7d09b93860
File size:109'515 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 492e90314f8eb23c3bd985348cfa9428
SHA1 hash: 58d15ea05341ef0acda88f0443e8687e71fc0a6d
SHA3-384 hash: d47784baf30b1a33ec883c1d4ce7373303026bfd4ea2a49e85cecd8acffefdd8ca6a9132a509340f7684db4100613b30
First seen:2022-11-24 19:38:11 UTC
Last seen:Never
Sightings:1
imphash : 5610cf02537f0325e444e82cdbae65b7
Create hunting rule
ssdeep : 768:9K1ZKM11gG4ChfiPO0rfz0shcUygmYUWTpSgrB5rC3iG8wDaT:9HMDgG4ChfiPOefgsOUYgr/G3GmaT
TLSH : T164B3A146B580F9B6E41601B30CABE7F6B6F6716C3C5A77C3BB40DB6ED87202116161CA
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:879e8ce8-6c2f-11ed-a71a-42010aa4000b
File name:400000.6847fdbe-66bf-4a20-bd97-d6919681d629.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Zusy-9978173-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.