YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 7bf9972a9a7c8783f39c4cbc5c58dbcdfae59e4e85fa4ca61f13330ecf9d46d7.

Scan Results

SHA256 hash: 7bf9972a9a7c8783f39c4cbc5c58dbcdfae59e4e85fa4ca61f13330ecf9d46d7
File size:30'066'040 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: c82fc94015ce499a146fc3d5b0fa95b1
SHA1 hash: 619ca5b203e382ac3190cd922d223d62285fb3d3
SHA3-384 hash: d07446ba12b0ad9b109fd802b614ad87107daebf8664b49db92220e92668b5deabdf757cd4700c14fa096bf4d48e18ad
First seen:2023-01-25 09:37:06 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 49152:kwqU8bzoWARikppVTmsC/r+L6G1X704LdZWKMVTmsC/ryL6GjX704LdZPEev+HeW:
TLSH : T1A467312055F7498BE3D3EA702FCCA5AEDA0AA7B3500D756710049717BA0DD9D8A4FB38
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:d55d5a85-9c93-11ed-98c2-42010aa4000b
File name:14803a88.dll
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:SUSP_Double_Base64_Encoded_Executable
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_Double_Base64_Encoded_Executable_RID34CC
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.