YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 358ebbe5fa784a66bfa912efd4480f681c392c1eba10cdf926df2d688e1b4e8b.
Scan Results
| SHA256 hash: | 358ebbe5fa784a66bfa912efd4480f681c392c1eba10cdf926df2d688e1b4e8b | |
|---|---|---|
| File size: | 1'398'544 bytes | |
| File download: | Original | |
| MIME type: | application/x-dosexec | |
| MD5 hash: | a3a67f854276e102a4e0e69350ced0d1 | |
| SHA1 hash: | b74dee281652249f7721a5b39211defde9dd6d15 | |
| SHA3-384 hash: | 13a1bfaaf911c4a5a498044079fd0a6d1f5e152fd84cd62fc180cdeaa23aadc0ada997b1f1c767d078ce370514dc1a3d | |
| First seen: | 2026-08-30 09:31:51 UTC | |
| Last seen: | 2026-08-30 09:31:51 UTC | |
| Sightings: | 2 | |
| imphash : | 49912cb2a04adee1ad2e2e4a80147918 | |
| ssdeep : | 24576:xArW/8hh0FQAq7c8nA7YMv3+DpBNPRI9ovlG4XozaEhptdAfCGzeYVxXNVD8pVVh:xe0mfW3YNPRRlG4saIprAN | |
| TLSH : | n/a | |
| telfhash : | n/a | |
| gimphash : | n/a | |
| dhash icon : | da9ae8cccecce8b6 | |
Tasks
There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | a1c30c39-a455-11f1-9de5-42010aa4000b | |
|---|---|---|
| File name: | 400000.svchcst.exe | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | {HEX}bin.downloader.small.9.UNOFFICIAL |
|---|
| Signature: | Win.Malware.Agen-7172367-0 |
|---|
| Signature: | Win.Malware.FlyAgent-9850229-1 |
|---|
| Signature: | Win.Malware.FlyAgent-9939767-1 |
|---|
| Signature: | Win.Malware.Gotango-7000352-0 |
|---|
| Signature: | Win.Malware.Ulise-9806872-0 |
|---|
| Signature: | Win.Malware.Zusy-5710245-0 |
|---|
| Signature: | Win.Packed.Zusy-9977987-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | command_and_control |
|---|---|
| Author: | CD_R0M_ |
| Description: | This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group |
| TLP: | TLP:WHITE |
| Repository: | CD-R0M |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Suspicious_Process |
|---|---|
| Author: | Security Research Team |
| Description: | Suspicious process creation |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | UPX |
|---|---|
| Author: | kevoreilly |
| Description: | UPX Unpacker: dump on OEP (original entry point) |
| TLP: | TLP:WHITE |
| Repository: | CAPE |
| Rule name: | upx_3 |
|---|---|
| Author: | Kevin Falcoz |
| Description: | UPX 3.X |
| TLP: | TLP:WHITE |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | UPXv20MarkusLaszloReiser |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | with_urls |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the presence of an or several urls |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| TLP: | TLP:WHITE |
| Rule name: | without_attachments |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the no presence of any attachment |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| TLP: | TLP:WHITE |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter
Task Information
| Task ID: | a1d549dd-a455-11f1-9de5-42010aa4000b | |
|---|---|---|
| File name: | 400000.6768a7dd-8a3f-4a9b-9b86-9c0d0253bb35.exe | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | {HEX}bin.downloader.small.9.UNOFFICIAL |
|---|
| Signature: | Win.Malware.Agen-7172367-0 |
|---|
| Signature: | Win.Malware.FlyAgent-9850229-1 |
|---|
| Signature: | Win.Malware.FlyAgent-9939767-1 |
|---|
| Signature: | Win.Malware.Gotango-7000352-0 |
|---|
| Signature: | Win.Malware.Ulise-9806872-0 |
|---|
| Signature: | Win.Malware.Zusy-5710245-0 |
|---|
| Signature: | Win.Packed.Zusy-9977987-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | command_and_control |
|---|---|
| Author: | CD_R0M_ |
| Description: | This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group |
| TLP: | TLP:WHITE |
| Repository: | CD-R0M |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Suspicious_Process |
|---|---|
| Author: | Security Research Team |
| Description: | Suspicious process creation |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | UPX |
|---|---|
| Author: | kevoreilly |
| Description: | UPX Unpacker: dump on OEP (original entry point) |
| TLP: | TLP:WHITE |
| Repository: | CAPE |
| Rule name: | upx_3 |
|---|---|
| Author: | Kevin Falcoz |
| Description: | UPX 3.X |
| TLP: | TLP:WHITE |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | UPXv20MarkusLaszloReiser |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | with_urls |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the presence of an or several urls |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| TLP: | TLP:WHITE |
| Rule name: | without_attachments |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the no presence of any attachment |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| TLP: | TLP:WHITE |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter