YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 909a9da9a1f47e503c348d59216494ade8d1fed8fd97e1435be1b0f98e156835.
Scan Results
| SHA256 hash: | 909a9da9a1f47e503c348d59216494ade8d1fed8fd97e1435be1b0f98e156835 | |
|---|---|---|
| File size: | 285'696 bytes | |
| File download: | Original | |
| MIME type: | application/x-dosexec | |
| MD5 hash: | 91be8f2b8ac1bb33407471ac19ec76cd | |
| SHA1 hash: | d187de5acac296d4fae493ae1d6dd59d60dd053e | |
| SHA3-384 hash: | 16b4a3714a1a29bbcbbf2ac777379801ce81104deb56aa3b62a24ffad5678806670a62843dd09e43e9bb9ac35e571238 | |
| First seen: | 2026-04-02 16:00:35 UTC | |
| Last seen: | 2026-04-02 16:03:34 UTC | |
| Sightings: | 2 | |
| imphash : | 266756be1bed0cb27666e233ae9063b1 | |
| ssdeep : | 6144:2FxWrV9tpp1HGEwAsl+XL/axhj+D6ohMoyygN:2FxWrV9tpPHGuLiR+WcMUgN | |
| TLSH : | n/a | |
| telfhash : | n/a | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | 803de462-2ead-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | 91be8f2b8ac1bb33407471ac19ec76cd | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | asyncrat |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect AsyncRat in memory |
| Reference: | internal research |
| TLP: | TLP:WHITE |
| Repository: | CAPE |
| Rule name: | Check_Debugger |
|---|---|
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Check_OutputDebugStringA_iat |
|---|---|
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| TLP: | TLP:WHITE |
| Rule name: | DebuggerCheck__RemoteAPI |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| TLP: | TLP:WHITE |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | malware_asyncrat |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect AsyncRat in memory |
| Reference: | internal research |
| TLP: | TLP:WHITE |
| Repository: | JPCERTCC |
| Rule name: | malware_asyncrat |
|---|---|
| Description: | detect AsyncRat in memory |
| Reference: | https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp |
| TLP: | TLP:WHITE |
| Repository: | JPCERTCC |
| Rule name: | NETDLLMicrosoft |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | TH_Win_ETW_Bypass_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Windows ETW Bypass Detection Rule - 2025 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | vmdetect |
|---|---|
| Author: | nex |
| Description: | Possibly employs anti-virtualization techniques |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | win_asyncrat_w0 |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect AsyncRat in memory |
| Reference: | internal research |
| TLP: | TLP:WHITE |
| Repository: | Malpedia |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter
Task Information
| Task ID: | 15b0a4dd-2ead-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | 909a9da9a1f47e503c348d59216494ade8d1fed8fd97e1435be1b0f98e156835.exe | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | asyncrat |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect AsyncRat in memory |
| Reference: | internal research |
| TLP: | TLP:WHITE |
| Repository: | CAPE |
| Rule name: | Check_Debugger |
|---|---|
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Check_OutputDebugStringA_iat |
|---|---|
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| TLP: | TLP:WHITE |
| Rule name: | DebuggerCheck__RemoteAPI |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| TLP: | TLP:WHITE |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | malware_asyncrat |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect AsyncRat in memory |
| Reference: | internal research |
| TLP: | TLP:WHITE |
| Repository: | JPCERTCC |
| Rule name: | malware_asyncrat |
|---|---|
| Description: | detect AsyncRat in memory |
| Reference: | https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp |
| TLP: | TLP:WHITE |
| Repository: | JPCERTCC |
| Rule name: | NETDLLMicrosoft |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | TH_Win_ETW_Bypass_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Windows ETW Bypass Detection Rule - 2025 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | vmdetect |
|---|---|
| Author: | nex |
| Description: | Possibly employs anti-virtualization techniques |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | win_asyncrat_w0 |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect AsyncRat in memory |
| Reference: | internal research |
| TLP: | TLP:WHITE |
| Repository: | Malpedia |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter