YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 3498fbb3c08220a982762ccf7bbe7142cd13fb6ba8cf5eace56b714b5adbb7e7.

Scan Results

SHA256 hash: 3498fbb3c08220a982762ccf7bbe7142cd13fb6ba8cf5eace56b714b5adbb7e7
File size:175'520 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 08e0a51deb5a5c5ecb2c96b20db1097a
SHA1 hash: 6c4cce7c02e81b458dfdd1d1862dc17fc27d334f
SHA3-384 hash: cf20268063e2c3663019b3380a255eaeb5def43b07e46ce5c339147b040b310b616941462728eb4a7b3b8b4cda9e1a88
First seen:2026-03-29 17:29:12 UTC
Last seen:Never
Sightings:1
imphash : b4c4decafa2305ff2e931b20daa9da16
Create hunting rule
ssdeep : 3072:EjOR/EnYXoLegbeC7mX5MVvKP1DxU5/5QMaucIrbXuwKnN8ms:MOR/EnAoLehCJydU/Pa14ywKum
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : b271e4e1c2e461b2
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:cd1f1e09-2b94-11f1-b47f-42010aa4000b
File name:08e0a51deb5a5c5ecb2c96b20db1097a
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.DownLoader16.29879.UNOFFICIAL
Create hunting rule
Signature:Win.Trojan.Agent-1361530
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:SVKProtectorv111
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.