YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 93a98e8b3ea282df9737094e35638a0949e7c63fcbd6c77c9785f49bfe844f23.

Scan Results

SHA256 hash:	93a98e8b3ea282df9737094e35638a0949e7c63fcbd6c77c9785f49bfe844f23
File size:	4'004'600 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	140b521bd80aba525a4bf14f6ca4ccd5
SHA1 hash:	81e3d6bca6cbb6d77e540f8f54646e74b653fdc5
SHA3-384 hash:	989ae5502ac2b9c239a45d346b409fd71684365f9a1d5bbac8c545ec685a02d387d472ae53f1ef122fcb64ee6b1fc61d
First seen:	2025-11-21 02:50:22 UTC
Last seen:	Never
Sightings:	1
imphash :	1627391100e211f34b2864d8c3c730fc Create hunting rule
ssdeep :	49152:eRhLMVB8QuDBDzT2/qGGjtVO88hXl+xS7PLjeTY:eRhLMVaQuVDfGGju/h1+A7PLR
TLSH :	T1B4066C01B3A14173E0739171C4A6AB699631BE712F32D78B6A44B61DBF337C19A36336 Create hunting rule
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	d2ca1f19-c684-11f0-adeb-42010aa4000b
File name:	140b521bd80aba525a4bf14f6ca4ccd5
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Gen.Variant.Symmi.60609.1338.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Gen.Variant.Symmi.60609.15099.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Gen.Variant.Symmi.60609.1512.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Virus.Win32.Virut.18522.29451.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Win32.Expiro.N.3311.16676.UNOFFICIAL Create hunting rule

Signature:	Win.Trojan.Revell-1 Create hunting rule

Signature:	YARA.telnet_cgi.UNOFFICIAL Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DevC4992BloodshedSoftware Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MinGWGCC3x Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	NET Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	telnet_cgi Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file telnet.cgi.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	win_rat_generic Create hunting rule
Author:	Reedus0
Description:	Rule for detecting generic RAT malware
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	win_stealer_generic Create hunting rule
Author:	Reedus0
Description:	Rule for detecting generic stealer malware
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/
TLP:	TLP:WHITE

Rule name:	yara_template Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.