YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 565470cb2db02be78f9166b087e20ef5ebd65ce920437bf5cb579e5052495d58.
Scan Results
| SHA256 hash: | 565470cb2db02be78f9166b087e20ef5ebd65ce920437bf5cb579e5052495d58 | |
|---|---|---|
| File size: | 7'309'152 bytes | |
| File download: | Original | |
| MIME type: | application/x-executable | |
| MD5 hash: | f3390fc1e51f1c714af17d57960525d0 | |
| SHA1 hash: | 666738e0fb9ee732df385b65157b1dd409fdf185 | |
| SHA3-384 hash: | 048bdafeb0c1e475112a02624eda644e2362dacc392cfae23ae91d8b585e3f8d4b90eec4ced26280496ab366cc8791b5 | |
| First seen: | 2026-09-19 10:15:05 UTC | |
| Last seen: | 2026-09-19 10:18:05 UTC | |
| Sightings: | 5 | |
| imphash : | n/a | |
| ssdeep : | 98304:KmNKIxVn08SPXx33Wsb5YneqjE7Cc4sS8LwG0etk6g0A:3n08SPXx3334nwwHm0J | |
| TLSH : | n/a | |
| telfhash : | t181e32122dcb2bfab0fc003776cb6d5c45357c04b0996bba95fa48375d4eb188847a35a | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 5 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | 66fadb83-b413-11f1-a0cd-42010aa4000b | |
|---|---|---|
| File name: | 565470cb2db02be78f9166b087e20ef5ebd65ce920437bf5cb579e5052495d58 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.29052.TSource.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | dsc |
|---|---|
| Author: | Aaron DeVera |
| Description: | Discord domains |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | MIRAI_TELNETCURL_payload |
|---|---|
| Author: | AfterPacket |
| Description: | Mirai-lineage ELF payload carrying the leaked-source decoy domain |
| Reference: | https://github.com/Afterpacket/drosera-threat-intel |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 4789cbb8-b413-11f1-a0cd-42010aa4000b | |
|---|---|---|
| File name: | 565470cb2db02be78f9166b087e20ef5ebd65ce920437bf5cb579e5052495d58.elf | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.29052.TSource.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | dsc |
|---|---|
| Author: | Aaron DeVera |
| Description: | Discord domains |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | MIRAI_TELNETCURL_payload |
|---|---|
| Author: | AfterPacket |
| Description: | Mirai-lineage ELF payload carrying the leaked-source decoy domain |
| Reference: | https://github.com/Afterpacket/drosera-threat-intel |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter
Task Information
| Task ID: | 430bb320-b413-11f1-a0cd-42010aa4000b | |
|---|---|---|
| File name: | 565470cb2db02be78f9166b087e20ef5ebd65ce920437bf5cb579e5052495d58 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.29052.TSource.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | dsc |
|---|---|
| Author: | Aaron DeVera |
| Description: | Discord domains |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | MIRAI_TELNETCURL_payload |
|---|---|
| Author: | AfterPacket |
| Description: | Mirai-lineage ELF payload carrying the leaked-source decoy domain |
| Reference: | https://github.com/Afterpacket/drosera-threat-intel |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 1e8c7880-b413-11f1-a0cd-42010aa4000b | |
|---|---|---|
| File name: | 565470cb2db02be78f9166b087e20ef5ebd65ce920437bf5cb579e5052495d58 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.29052.TSource.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | dsc |
|---|---|
| Author: | Aaron DeVera |
| Description: | Discord domains |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | MIRAI_TELNETCURL_payload |
|---|---|
| Author: | AfterPacket |
| Description: | Mirai-lineage ELF payload carrying the leaked-source decoy domain |
| Reference: | https://github.com/Afterpacket/drosera-threat-intel |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | fc1642d8-b412-11f1-a0cd-42010aa4000b | |
|---|---|---|
| File name: | 565470cb2db02be78f9166b087e20ef5ebd65ce920437bf5cb579e5052495d58 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.29052.TSource.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | dsc |
|---|---|
| Author: | Aaron DeVera |
| Description: | Discord domains |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | MIRAI_TELNETCURL_payload |
|---|---|
| Author: | AfterPacket |
| Description: | Mirai-lineage ELF payload carrying the leaked-source decoy domain |
| Reference: | https://github.com/Afterpacket/drosera-threat-intel |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found