YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 9cecfb2a33a7963f3ffc3c73ba3d8da6fa09e1b5b3b3c5249ae039d4a2fc191b.

SHA256 hash:	9cecfb2a33a7963f3ffc3c73ba3d8da6fa09e1b5b3b3c5249ae039d4a2fc191b
File size:	680'021 bytes
File download:	Original
MIME type:	text/plain
MD5 hash:	252d753895177c66f58e5b150ff5fbca
SHA1 hash:	c7df1adce063c689b01dc0a288120914e50bac49
SHA3-384 hash:	fbc7c9eca71e2401687b14cdb09ac9f06be79c2a181df43375bb1bd3624c3c6f4f2e50c2cd27a6ee3fdb5586cff0fc79
First seen:	2026-08-30 09:02:23 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	12288:VedLwbV/j66BvTMiDUzTS9tpsZl2oniCrarUmH8/:V48J66BTZDUa9tpadiLrUU0
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-08-30 09:02:23 UTC Static: 4 Unpacker: 0 ClamAV: 0