YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 381c92cb76c2fa5bb5eedc8dba3f927d563336b3a764d9378e8b34390cc3afbe.

SHA256 hash:	381c92cb76c2fa5bb5eedc8dba3f927d563336b3a764d9378e8b34390cc3afbe
File size:	598'016 bytes
File download:	Original
MIME type:	application/octet-stream
MD5 hash:	c4bcbcfd309ffdf6fd39d4e464bdbb9b
SHA1 hash:	984e0d21d7560dda2be312950c42f62d3f0d103b
SHA3-384 hash:	eb3c2b34eee440b05e317d930faf78dff0d07094fb18d6dd6b8ae5a1e0ec77ab5e0327829dcf4285a278f70f5658232b
First seen:	2026-09-19 11:30:46 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	6144:+7jGTIazAMhyfPOpdBevp6RnTxS1FvASG8QPznQQyztYXOlWPGOlWP:+7jDO3Ew6FvASGS7S+OvO
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-09-19 11:30:46 UTC Static: 3 Unpacker: 0 ClamAV: 0