YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 475b61eb10b8434e7e2b578094c99bf9d8dd1ca7f2f053782496a3413802674b.

Scan Results

SHA256 hash: 475b61eb10b8434e7e2b578094c99bf9d8dd1ca7f2f053782496a3413802674b
File size:204'800 bytes
File download: Original
MIME type:application/octet-stream
MD5 hash: d3219c84d2006b654403675aaf2d7645
SHA1 hash: a651fd0a07134bf946bf156a4a5fe23c09d0257c
SHA3-384 hash: 4c4fb11b7dc7759fb07f4ac8115341a5a845abae5774a9637c95c2ac552377fd0706b722ca3500489ec6f0acc2b91230
First seen:2026-04-01 16:49:55 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 3072:DZmt0nF2wmMabNUel7deiH4MgvF2wmMabNUel7deiH4Mg0:Q0nwBPxdnH/gvwBPxdnH/g0
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:cf8671f8-2dea-11f1-b47f-42010aa4000b
File name:42e0000.shc
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.