YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 8ca274b18b2dfb9a31ba5b0bccceaf6fb41cf2673d38435324cc3461604d27d9.

Scan Results

SHA256 hash: 8ca274b18b2dfb9a31ba5b0bccceaf6fb41cf2673d38435324cc3461604d27d9
File size:87'820 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 0728ab0fd0b1c4ed680cf7d8f7813a18
SHA1 hash: afe8d232eac6099dc35414633c4220278bc9d0f4
SHA3-384 hash: a9592f1d61a7dee7726735a41c2f994d46e8ef327a8bb0eaf93d4856b1cfbeb36b465a917549d723770a7e43c400af63
First seen:2026-04-12 14:37:31 UTC
Last seen:Never
Sightings:1
imphash : 57e98d9a5a72c8d7ad8fb7a6a58b3daf
Create hunting rule
ssdeep : 1536:wdnREfs9ke7FggdycASuPv2WIw/4akS5lwHBDP8D46dH:wdRGsvFggQc1D7KEFT8Ms
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 8230f0aab2ec7082
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:235e051f-367d-11f1-bfeb-42010aa4000b
File name:0728ab0fd0b1c4ed680cf7d8f7813a18
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.PWS.Banker1.30494.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
TLP:TLP:WHITE
Repository:StrangerealIntel
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.