YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash a8ed5f5718e41a1aa51852a407111408824ab7aff0d8beb6798bc06ed8946b82.

Scan Results

SHA256 hash: a8ed5f5718e41a1aa51852a407111408824ab7aff0d8beb6798bc06ed8946b82
File size:289'792 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 80b0626e8dd1a019814ae37c37612c0a
SHA1 hash: 9d7d7bb78dfbd7e4134d8cdd683d95cb453aeffc
SHA3-384 hash: 4bc1ff9ad730e1776f31887c378eab3d6988d254a7ac4f913cc7ca03eb1f87ce8cc7956bc8c702cf6fea57fbeb229435
First seen:2026-01-15 15:29:02 UTC
Last seen:Never
Sightings:1
imphash : a38ad86d74cafc45094a5085e33419e4
Create hunting rule
ssdeep : 6144:7cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37VoCMA:7cW7KEZlPzCy37VoCD
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 59c4a6969292d845
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:eb7d6868-f226-11f0-9df4-42010aa4000b
File name:80b0626e8dd1a019814ae37c37612c0a
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Dropper.Darkkomet-9857869-0
Create hunting rule
Signature:Win.Dropper.Zeus-9820070-0
Create hunting rule
Signature:Win.Malware.Darkkomet-9857872-0
Create hunting rule
Signature:Win.Trojan.DarkKomet-1
Create hunting rule
Signature:Win.Trojan.Darkkomet-6745084-0
Create hunting rule
Signature:Win.Trojan.Darkkomet-6745294-0
Create hunting rule
Signature:Win.Trojan.Darkkomet-7113180-0
Create hunting rule
Signature:Win.Trojan.Darkkomet-9857871-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:ProjectM_DarkComet_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects ProjectM Malware
Reference:http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:ProjectM_DarkComet_1_RID2E9E
Create hunting rule
Author:Florian Roth
Description:Detects ProjectM Malware
Reference:http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/
TLP:TLP:WHITE
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
TLP:TLP:WHITE
Repository:YARAify
Rule name:UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXProtectorv10x2
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:classified
Author:classified
TLP :TLP:GREEN
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.