YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 72ec5533b7a27ed0e53ae2b2e691c94b920f9f14831c697c780e9ef48f97805e.

Scan Results

SHA256 hash: 72ec5533b7a27ed0e53ae2b2e691c94b920f9f14831c697c780e9ef48f97805e
File size:1'558'404 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 08854ac1c24502bc022de0b2acef809d
SHA1 hash: b93b83a4d01630d03bdf132878781d83abcecf58
SHA3-384 hash: 0152987c33c89d1ee39d27379c815fd41fea7db5028627dd5b4a6433bd4512915f4c4e47b671288c45a6b2954c76ed08
First seen:2026-03-22 19:09:09 UTC
Last seen:Never
Sightings:1
imphash : 8d0049281f7a49486287791e14061feb
Create hunting rule
ssdeep : 12288:vkss8WBTGv5GihrvzxAwSfxL/2Dc3jDLLmt0LDQewsAjRx:Mss86TYTZOaewsAjn
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 9288ce8c2a868f92
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:9ab4e8ee-2622-11f1-b47f-42010aa4000b
File name:08854ac1c24502bc022de0b2acef809d
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.ArvhiveBomb.19703.10835.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.Trojan.GenericKD.46115174.2967.30729.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.Trojan.GenericKD.79202868.16258.8962.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.W64.Blackie.T.gen.Eldorado.UNOFFICIAL
Create hunting rule
Signature:Win.Ransomware.Azvo-9979243-0
Create hunting rule
Signature:YARA.SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
TLP:TLP:WHITE
Repository:YARAify
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
TLP:TLP:WHITE
Repository:
Rule name:SUSP_NullSoftInst_Combo_Oct20_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious NullSoft Installer combination with common Copyright strings
Reference:https://twitter.com/malwrhunterteam/status/1313023627177193472
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
TLP:TLP:WHITE
Repository:YARAify
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.