YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 4ab8f0609952162eba2f9ec94eca255877ecb582cf2123b35de8b4e6c23e546a.

Scan Results

SHA256 hash: 4ab8f0609952162eba2f9ec94eca255877ecb582cf2123b35de8b4e6c23e546a
File size:204'800 bytes
File download: Original
MIME type:application/octet-stream
MD5 hash: 5fec34ba7cc0234e5b0bcb84ee692b52
SHA1 hash: aa4c1a93534346fdd61a68b0e27c62e00663941c
SHA3-384 hash: 03dee4b3fa9f56eefda0d8d05f8320e63d7fa047945fc691afb18f0ab1a9bb3c792d5c78eadd5828c1072aedf0c9731a
First seen:2026-04-07 01:01:14 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 3072:dAWUFuHZNSOnoczsHanq6X9boTb7mVFuHZNSOnoczsHanq6X9boTb7u:ZUAHZ9ZgHaq6aT+VAHZ9ZgHaq6aT2
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:468c390a-321d-11f1-b47f-42010aa4000b
File name:4300000.shc
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.