YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 34f74f96e011af6c7c625fcc2d643d2aee08d74fdab335218c889a202ce325fc.

Scan Results

SHA256 hash: 34f74f96e011af6c7c625fcc2d643d2aee08d74fdab335218c889a202ce325fc
File size:380'928 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 9a5c92fcfc005579486d8a8d4893418c
SHA1 hash: 060e0fb10027dae98c1758712ab8fdd8351063af
SHA3-384 hash: 2370d90728bb43fb61df5b9e502a9d6758994c898d3e1dacadfbcbe214aed0885faeccff4e2ba0b0bff910f0ffe6f9b5
First seen:2023-01-25 09:39:02 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 6144:RcHiu0srKxP6nVMg1FENy/V/5c6thb+lazG87rIr7rVrprCbdoS:y50srcyLjN/5c6thb+lazG4RoS
TLSH : T141844A12F7920A84E15E36312DEBC7E256B3F8084F1B864B72A4677E2C72E210D75B57
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:1a24e95f-9c94-11ed-98c2-42010aa4000b
File name:400000.winlogon.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Keylogger.Windef-7136116-0
Create hunting rule
Signature:Win.Malware.Vobfus-7647990-0
Create hunting rule
Signature:Win.Packed.Shakblades-9811684-0
Create hunting rule
Signature:Win.Trojan.Blackshades-2
Create hunting rule
Signature:Win.Worm.Swisyn-6853810-0
Create hunting rule
Signature:Win.Worm.Vobfus-9982088-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:MALWARE_Win_BlackshadesRAT
Create hunting rule
Author:ditekSHen
Description:BlackshadesRAT / Cambot POS payload
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify
Rule name:RAT_BlackShades
Create hunting rule
Author:Brian Wallace (@botnet_hunter)
Description:Detects BlackShades RAT
Reference:http://blog.cylance.com/a-study-in-bots-blackshades-net
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:win_blackshades_w0
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
TLP:TLP:WHITE
Repository:Malpedia

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.