YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash aacf47eee973d0975903ae7744b4bdee35c21146bdd4b4e6147fbe2588346cfe.

Scan Results

SHA256 hash:	aacf47eee973d0975903ae7744b4bdee35c21146bdd4b4e6147fbe2588346cfe
File size:	36'903'936 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	0f8986ce248f1c60f77fbaec3f011e6c
SHA1 hash:	1f0cb5d362c89874af69e4252c718536a7fe03c9
SHA3-384 hash:	26e02fc08217e1affe70434f265cc91cd51aa67c9147177c5d4b8a844d299c11011c147924fd979e7a23c8e750c0c359
First seen:	2026-04-01 16:58:48 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	393216:rE0Z6JKzWraVJLpX6iokXE6FEAzbVUem+9aR0oLZ3aVwfuk3HavmYGYA+LDfv:rE0Z6JK6roOhZj3HgmpYRLjv
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	489669d8d8699648 Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	0e1bee9f-2dec-11f1-b47f-42010aa4000b
File name:	0f8986ce248f1c60f77fbaec3f011e6c
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

No matches

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	Agent_BTZ Create hunting rule
TLP:	TLP:WHITE
Repository:	Intezer

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	Anydesk Create hunting rule
Author:	CD_R0M_
Description:	Anydesk is commonly used by threat actors for remote access. This rule aims to identify legitimate anydesk, renamed binaries and trojanized versions.
Reference:	https://www.crowdstrike.com/blog/falcon-complete-disrupts-malvertising-campaign-targeting-anydesk/
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:GREEN

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	dl_shadow Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants
TLP:	TLP:WHITE
Repository:

Rule name:	pe_no_import_table Create hunting rule
Author:
Description:	Detect pe file that no import table
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants
TLP:	TLP:WHITE
Repository:

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants
TLP:	TLP:WHITE
Repository:

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants
TLP:	TLP:WHITE
Repository:

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Sus_AnyDesk_Attempts_Feb2024 Create hunting rule
Author:	Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	TH_APT_EquationGroup_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Equation Group (G0020) APT malware detection - covers EquationDrug, GrayFish, DoubleFantasy, TripleFantasy, Fanny, GROK, nls_933w HDD firmware module, and Shadow Brokers tooling
Reference:	https://cyfare.net/
TLP:	TLP:WHITE
Repository:	YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.