YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash a85cb00e08eb335587948eeae1c1b660420e26c2d0f61c2fa41e3dc55e047975.

SHA256 hash:	a85cb00e08eb335587948eeae1c1b660420e26c2d0f61c2fa41e3dc55e047975
File size:	10'178'560 bytes
File download:	Original
MIME type:	application/octet-stream
MD5 hash:	153b3f2fb271953f66538daa3959b1e5
SHA1 hash:	d807acdb1af118121e064c37481eec68769159e6
SHA3-384 hash:	76ccd989fff4684fcaf3e66ea3098cd6523c66571616492178872ca3674f1961e3023c0f2a973bdad4bec3d3fa64c3ff
First seen:	2026-10-10 06:51:30 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	49152:S6MVX/SwHmfBGL4gd1OicBdNL6GKcBdhkiNwcMQ/LlL6GjGL4gd1OFcBdvkzGL4X:te/P4/bDu1rHBZDE3Xcny
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_Double_Base64_Encoded_Executable_RID34CC Create hunting rule
Author:	Florian Roth
Description:	Detects an executable that has been encoded with base64 twice
Reference:	https://twitter.com/TweeterCyber/status/1189073238803877889
TLP:	TLP:WHITE

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-10-10 06:51:31 UTC Static: 4 Unpacker: 0 ClamAV: 0