YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 4798402b9635ccdd786bdc70b93fc7ecf151b4029309b314260e88dfd81f5b6b.

SHA256 hash:	4798402b9635ccdd786bdc70b93fc7ecf151b4029309b314260e88dfd81f5b6b
File size:	27'042 bytes
File download:	Original
MIME type:	text/x-shellscript
MD5 hash:	95148211d83a0d0b818388f1a8d7b94d
SHA1 hash:	8c0739441765248d56d129ba2e3898ee7f4a9a6f
SHA3-384 hash:	eff4c38f522c13611df10380f47bc7da72cd7caeef9a019b99629410042ec2c0859e3baf1b78f783aa4ffe36cea0150e
First seen:	2026-09-19 11:03:21 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	768:Rn8vCB+25j6es8Rp9FYpMSUpi+20qUpi+20YQX:Rn8l25JPd2QX
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task ID:	ba6cae28-b419-11f1-a0cd-42010aa4000b
File name:	4798402b9635ccdd786bdc70b93fc7ecf151b4029309b314260e88dfd81f5b6b.sh
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	JOMANGYStager_2ndStage Create hunting rule
Author:	abuse.ch
Description:	Detects JOMANGYStager Bash Script
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_LNX_Base64_Exec_Apr24 Create hunting rule
Author:	Christian Burkard
Description:	Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:	Internal Research
TLP:	TLP:WHITE

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-09-19 11:03:22 UTC Static: 3 Unpacker: 0 ClamAV: 0