YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 5b85b0120f349326c491bec37468601c22c3dba5d4b77e809c433ec39f70b1d0.

Scan Results

SHA256 hash: 5b85b0120f349326c491bec37468601c22c3dba5d4b77e809c433ec39f70b1d0
File size:2'558'016 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: bb5f0f888bcf1cfb4cab98731a6ebdcb
SHA1 hash: 3e5812feb2905dd8390ba8373ee685ad9df69ce8
SHA3-384 hash: c10fbadcf6d8444af10869d5d6720035f8dbd5c28e8b9f04edf6404d37240ad1b374192f45f3fdffd2faf59117f0fd94
First seen:2022-11-24 19:52:00 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 6144:jC89XR7BKB97RgtPzoT+JYVj1kZQMBtjrJjO6138PrhN:jCCpBKB97RgtPzoT+6j1WOhN
TLSH : T149C53055CC41859EC5764AF1CCFA8974733320CB720A0F0657DEA621FDA224E6BD1AFA
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:761c84d6-6c31-11ed-a71a-42010aa4000b
File name:1485b7c0.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.CoinMiner-20.UNOFFICIAL
Create hunting rule
Signature:Win.Trojan.B-468
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:MALWARE_Win_NjRAT
Create hunting rule
Author:ditekSHen
Description:Detects NjRAT / Bladabindi
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:RAT_njRat
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects njRAT
Reference:http://malwareconfig.com/stats/njRat
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:classified
Author:classified
TLP :TLP:GREEN
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter <bwall@ballastsecurity.net>
Description:Identify njRat
TLP:TLP:WHITE
Repository:Malpedia
Rule name:Windows_Trojan_Njrat_30f3c220
Create hunting rule
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.