YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 8f9cf4b8c61692105ec00ff7ae97e9b791cc320de6fe627a86939317cfa4951e.

SHA256 hash:	8f9cf4b8c61692105ec00ff7ae97e9b791cc320de6fe627a86939317cfa4951e
File size:	3'166'208 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	16b15f8927ee5962220f97700fd325e3
SHA1 hash:	3c82c7579519f1bd59def371c75abe8a94a15073
SHA3-384 hash:	d35495efa338b579150c35146b4fef80a1205bb72d7650684947a26a2191fd6a11b7d2f47090f0ee37ac74d0a7cb7eaa
First seen:	2026-04-27 14:50:39 UTC
Last seen:	Never
Sightings:	1
imphash :	f34d5f2d4577ed6d9ceec516c1f5a744 Create hunting rule
ssdeep :	12288:NwH4IC0RfpEti4i+zo/V/mCdLepdJOZRDRXciYJvjrxZvSJoEWJ9pIOVgWOyJIfd:fufoNzBfl/wauLqGthXv2EeL
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	pe_imphash Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-04-27 14:50:40 UTC Static: 5 Unpacker: 0 ClamAV: 0