YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 8186cecf2439522124f4f90e186c364532d4abe20fe226e0e34c1fc99a030176.

SHA256 hash:	8186cecf2439522124f4f90e186c364532d4abe20fe226e0e34c1fc99a030176
File size:	2'687'826 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	05786b531e80ff98405127597d72c259
SHA1 hash:	9d4a3d7a86285bb576e27c941662cc39c8a98162
SHA3-384 hash:	c33f6f922c77bb2817615ddb9ee0befdc0eddefcb612fa0f645f96229309d0c5ea1a2524238947f5bc7f99509e85f2d6
First seen:	2025-11-21 02:44:43 UTC
Last seen:	Never
Sightings:	1
imphash :	37c6c0cc4d20c311c793c6b743da8942 Create hunting rule
ssdeep :	49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/1:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/1
TLSH :	T1EAC5D1D93B0A79C8FD3F6F7738C9226A6A7E0B3D109B0DC2657C62514509F6E92805CB Create hunting rule
telfhash :	n/a
gimphash :	n/a
dhash icon :	6944c48a83599a82 Create hunting rule

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

Signature:	PUA.Win.Packer.EnigmaProtector-9852682-0 Create hunting rule

Signature:	Win.Dropper.DarkKomet-9998306-0 Create hunting rule

Signature:	Win.Malware.Reconyc-10028301-0 Create hunting rule

The following YARA rules matched on the file (static analysis).

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)
TLP:	TLP:WHITE
Repository:

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-11-21 02:44:43 UTC Static: 2 Unpacker: 0 ClamAV: 3