YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 6e465858544cd155d68ccb644a3d2fdabba30e04933fa346b5a29beae97dc696.

Scan Results


SHA256 hash: 6e465858544cd155d68ccb644a3d2fdabba30e04933fa346b5a29beae97dc696
File size:2'237'784 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 6279ecd55e6f9c50149c2498a71011e6
SHA1 hash: 447aa0265d8aa9daf8a2ba7722990e2dbc12cba9
SHA3-384 hash: 43d0f1393d9e5f94f81e1c6e6b87fd3dbe2e8391679b4ed688737a7a4c16ab11e0f8cefb16102685716475f36ea75637
First seen:2022-11-24 19:43:06 UTC
Last seen:Never
Sightings:1
imphash : dae02f32a21e03ce65412f6e56942daa
ssdeep : 49152:+Qz4rLuoQz4rLuoQz4rLuYQz4rLu1Qz4rLuxLoSUIbLoSUIaAFchAFchAFcUA:+c8LLc8LLc8Llc8LKc8LqoPIvoPIaAFa
TLSH : T185A50222A798853FE2DE967A712656138379C2D39CD3F7DF28D4A1A35A163F406132C3
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:379b8b5a-6c30-11ed-a71a-42010aa4000b
File name:5502aa8.dll
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Dropper.Nancrat-9869495-0
Signature:Win.Dropper.Nanocore-9916514-0
Signature:Win.Packed.Generic-9777790-0
Signature:Win.Trojan.Generic-9783914-0
Signature:Win.Trojan.Nanocore-5
Signature:Win.Trojan.NanoCore-9852758-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:ach_NanoCore
Author:abuse.ch
TLP:TLP:WHITE
Repository:sandnet
Rule name:malware_Nanocore_strings
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
TLP:TLP:WHITE
Repository:JPCERTCC
Rule name:MALWARE_Win_NanoCore
Author:ditekSHen
Description:Detects NanoCore
TLP:TLP:WHITE
Repository:ditekshen
Rule name:nanocore_rat
Author:jeFF0Falltrades
TLP:TLP:WHITE
Repository:jeFF0Falltrades
Rule name:Nanocore_RAT_Gen_2
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:Nanocore_RAT_Gen_2_RID2D96
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:TLP:WHITE
Rule name:win_nanocore_w0
Author:Kevin Breen <kevin@techanarchy.net>
TLP:TLP:WHITE
Repository:malpedia
Rule name:Windows_Trojan_Nanocore_d8c4e3c5
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.