YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 45573483e8a05c086dc23015013ffaf206883df61ed4759eb0016b51f168b8b9.

Scan Results

SHA256 hash:	45573483e8a05c086dc23015013ffaf206883df61ed4759eb0016b51f168b8b9
File size:	1'990'871 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	08f53d7adeac6f3eec659c1bf472caa7
SHA1 hash:	47312589da45f8a1e7f5c23c6cc287ac500fe9eb
SHA3-384 hash:	23bce21cf6cefd11ac778af78633bce5b62a201525acefc1e5bfa771044d75fe1babd23272c4b16add2c43d187292134
First seen:	2025-11-20 23:49:57 UTC
Last seen:	Never
Sightings:	1
imphash :	53d02dee8a3558f2a2295b34eb0d6374 Create hunting rule
ssdeep :	49152:9bYwIkppGR1b7ph7GBfW7ph7GBfWI6TKB:ycc77GBfW777GBfWA
TLSH :	T1BF95071273E58031F5F33A7059B992744A7BBC619B39C6CF62C8590E6FB2AD08934763 Create hunting rule
telfhash :	n/a
gimphash :	n/a
dhash icon :	f8ba6c0e0ec982c0 Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	9eb04ea0-c66b-11f0-adeb-42010aa4000b
File name:	08f53d7adeac6f3eec659c1bf472caa7
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.PUA.Tool.BtcMine-2.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Virus.Win32.Sality.10790.9565.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Virus.Win32.Virut.26024.31203.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.W32.Agent.3D58.tr.1259.14147.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.W32.Agent.CPL.tr.12645.18404.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.W32.Virut.D.gen.Eldorado.11790.28372.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Win32.Sality.16046.21162.UNOFFICIAL Create hunting rule

Signature:	TwinWave.EvilLNK.WeaponisedLove.M1.20250617.UNOFFICIAL Create hunting rule

Signature:	Win.Dropper.Tiggre-9845940-0 Create hunting rule

Signature:	Win.Malware.Score-6940809-0 Create hunting rule

Signature:	Win.Trojan.Qhost-160 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	BlackMoon Create hunting rule
Author:	NDA0E
Description:	Detects BlackMoon
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	blackmoon_payload_v1 Create hunting rule
Author:	RandomMalware
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MALWARE_Win_BlackMoon Create hunting rule
Author:	ditekSHen
Description:	Detects executables using BlackMoon RunTime
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	virustotal Create hunting rule
Author:	Tracel
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.