YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 34f74f96e011af6c7c625fcc2d643d2aee08d74fdab335218c889a202ce325fc
.
Scan Results
SHA256 hash: | 34f74f96e011af6c7c625fcc2d643d2aee08d74fdab335218c889a202ce325fc | |
---|---|---|
File size: | 380'928 bytes | |
File download: | Original | |
MIME type: | application/x-dosexec | |
MD5 hash: | 9a5c92fcfc005579486d8a8d4893418c | |
SHA1 hash: | 060e0fb10027dae98c1758712ab8fdd8351063af | |
SHA3-384 hash: | 2370d90728bb43fb61df5b9e502a9d6758994c898d3e1dacadfbcbe214aed0885faeccff4e2ba0b0bff910f0ffe6f9b5 | |
First seen: | 2023-01-25 09:39:02 UTC | |
Last seen: | Never | |
Sightings: | 1 | |
imphash : | n/a | |
ssdeep : | 6144:RcHiu0srKxP6nVMg1FENy/V/5c6thb+lazG87rIr7rVrprCbdoS:y50srcyLjN/5c6thb+lazG4RoS | |
TLSH : | T141844A12F7920A84E15E36312DEBC7E256B3F8084F1B864B72A4677E2C72E210D75B57 | |
telfhash : | n/a | |
gimphash : | n/a | |
dhash icon : | n/a |
Tasks
You can browse the 10 most recent tasks associated with this file blow.
Task Information
Task ID: | 1a24e95f-9c94-11ed-98c2-42010aa4000b | |
---|---|---|
File name: | 400000.winlogon.exe | |
Task parameters: | ClamAV scan: | True |
Unpack: | False | |
Share file: | True |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
Signature: | Win.Keylogger.Windef-7136116-0 |
---|
Signature: | Win.Malware.Vobfus-7647990-0 |
---|
Signature: | Win.Packed.Shakblades-9811684-0 |
---|
Signature: | Win.Trojan.Blackshades-2 |
---|
Signature: | Win.Worm.Swisyn-6853810-0 |
---|
Signature: | Win.Worm.Vobfus-9982088-0 |
---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
Rule name: | command_and_control |
---|---|
Author: | CD_R0M_ |
Description: | This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group |
TLP: | TLP:WHITE |
Repository: | CD-R0M |
Rule name: | MALWARE_Win_BlackshadesRAT |
---|---|
Author: | ditekSHen |
Description: | BlackshadesRAT / Cambot POS payload |
TLP: | TLP:WHITE |
Repository: | ditekshen |
Rule name: | meth_get_eip |
---|---|
Author: | Willi Ballenthin |
TLP: | TLP:WHITE |
Repository: | yaraify |
Rule name: | RAT_BlackShades |
---|---|
Author: | Brian Wallace (@botnet_hunter) |
Description: | Detects BlackShades RAT |
Reference: | http://blog.cylance.com/a-study-in-bots-blackshades-net |
TLP: | TLP:WHITE |
Repository: | Neo23x0 |
Rule name: | win_blackshades_w0 |
---|---|
Author: | Jean-Philippe Teissier / @Jipe_ |
TLP: | TLP:WHITE |
Repository: | malpedia |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter