YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash a55326ed6348105cb2de76f8a3d856b9da1d40d66c7060285df891f1db3e4d81.
Scan Results
| SHA256 hash: | a55326ed6348105cb2de76f8a3d856b9da1d40d66c7060285df891f1db3e4d81 | |
|---|---|---|
| File size: | 1'966'080 bytes | |
| File download: | Original | |
| MIME type: | application/x-executable | |
| MD5 hash: | 6833f5fab6b541ca378db95ab9c64113 | |
| SHA1 hash: | 75a2577ee4be6f838086b030ef1654e0cc38ff80 | |
| SHA3-384 hash: | 11e604a8501ad5557036b8a130ee0662be72a42555fdf33efc1d8fd65ffd0a70125009524a0d74461769aac3975adbe4 | |
| First seen: | 2026-10-09 23:11:02 UTC | |
| Last seen: | 2026-10-09 23:15:03 UTC | |
| Sightings: | 6 | |
| imphash : | n/a | |
| ssdeep : | 24576:ezMgZhaFYyu4ykjNa7jz7fix/2pMFA7jV2pPKMcQaohcVBb8PGOyE5FgxAeiOmx5:HYRRLTBZtmxscTm4j1 | |
| TLSH : | n/a | |
| telfhash : | t16dd0123d5b1d0d5c3feae180240e06e949d92d700711262a8f1167135951fe1768dd6f | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 6 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | 41e9c008-c437-11f1-b2b6-42010aa4000b | |
|---|---|---|
| File name: | a55326ed6348105cb2de76f8a3d856b9da1d40d66c7060285df891f1db3e4d81 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_all_IPv6_variants |
|---|---|
| Author: | Bierchermuesli |
| Description: | Generic IPv6 catcher |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 1dfd5364-c437-11f1-b2b6-42010aa4000b | |
|---|---|---|
| File name: | a55326ed6348105cb2de76f8a3d856b9da1d40d66c7060285df891f1db3e4d81 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_all_IPv6_variants |
|---|---|
| Author: | Bierchermuesli |
| Description: | Generic IPv6 catcher |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 01c96533-c437-11f1-b2b6-42010aa4000b | |
|---|---|---|
| File name: | a55326ed6348105cb2de76f8a3d856b9da1d40d66c7060285df891f1db3e4d81.elf | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_all_IPv6_variants |
|---|---|
| Author: | Bierchermuesli |
| Description: | Generic IPv6 catcher |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter
Task Information
| Task ID: | f9ec68c5-c436-11f1-b2b6-42010aa4000b | |
|---|---|---|
| File name: | a55326ed6348105cb2de76f8a3d856b9da1d40d66c7060285df891f1db3e4d81 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_all_IPv6_variants |
|---|---|
| Author: | Bierchermuesli |
| Description: | Generic IPv6 catcher |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | d6642651-c436-11f1-b2b6-42010aa4000b | |
|---|---|---|
| File name: | a55326ed6348105cb2de76f8a3d856b9da1d40d66c7060285df891f1db3e4d81 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_all_IPv6_variants |
|---|---|
| Author: | Bierchermuesli |
| Description: | Generic IPv6 catcher |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | b2a36765-c436-11f1-b2b6-42010aa4000b | |
|---|---|---|
| File name: | a55326ed6348105cb2de76f8a3d856b9da1d40d66c7060285df891f1db3e4d81 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_all_IPv6_variants |
|---|---|
| Author: | Bierchermuesli |
| Description: | Generic IPv6 catcher |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_Go_GOMAXPROCS |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Rule name: | DetectGoMethodSignatures |
|---|---|
| Author: | Wyatt Tauber |
| Description: | Detects Go method signatures in unpacked Go binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseunix2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise UNIX |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | F01_s1ckrule |
|---|---|
| Author: | s1ckb017 |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | GoBinTest |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Golang_Find_CSC846 |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Golang_Find_CSC846_Simple |
|---|---|
| Author: | Ashar Siddiqui |
| Description: | Find Go Signatuers |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|
| Rule name: | classified |
|---|
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | ProgramLanguage_Golang |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Golang programming language |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found