YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 73fd51d4a0959e5c5a82db9be0d765069d02a2b97f51f55f5d6422a7bec01caa.

Scan Results

SHA256 hash: 73fd51d4a0959e5c5a82db9be0d765069d02a2b97f51f55f5d6422a7bec01caa
File size:50'176 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 23de0f4fae682890e883c47882575d74
SHA1 hash: f9cd8689dba1d2f27292cdbeafd37888e04d27b9
SHA3-384 hash: a047dea4532f5508e8a7df22f9398ad496708aad824c91d286578ba1ccc82cce82b1d1143a0c2d83e6fbd86bf99e63f9
First seen:2025-06-07 21:44:16 UTC
Last seen:2025-06-10 06:15:31 UTC
Sightings:2
imphash : 88ebf4523b91276ac87aa5a2359af79b
Create hunting rule
ssdeep : 384:2ClvbOnWVvYyktU5o5RbZf3mPFztNI4KJ5WufojglzEihFA/+lJEmHdGK2elYRim:mR3QTABRlnZ2hRiK42C34qieRtR9Suo
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:4fc53675-45c2-11f0-9b97-42010aa4000b
File name:73fd51d4a0959e5c5a82db9be0d765069d02a2b97f51f55f5d6422a7bec01caa.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:amatera
Create hunting rule
Author:Nikos 'n0t' Totosis
Description:Amatera Stealer Payload
TLP:TLP:WHITE
Repository:YARAify
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
TLP:TLP:WHITE
Repository:

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.

Task Information

Task ID:8f9ccaad-43e8-11f0-9b97-42010aa4000b
File name:23de0f4fae682890e883c47882575d74
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:amatera
Create hunting rule
Author:Nikos 'n0t' Totosis
Description:Amatera Stealer Payload
TLP:TLP:WHITE
Repository:YARAify
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
TLP:TLP:WHITE
Repository:

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.