YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash b7960f8c6a47a59d2e32a17a673ac03b9cf3e7af8c6dfdab74f54383b4e6d788.

SHA256 hash:	b7960f8c6a47a59d2e32a17a673ac03b9cf3e7af8c6dfdab74f54383b4e6d788
File size:	10'178'560 bytes
File download:	Original
MIME type:	application/octet-stream
MD5 hash:	c50ae0761d36bd28b0eca5a15c95707d
SHA1 hash:	1a5ddfd2bfb0d01f76048b4e41abb2a8c62fd667
SHA3-384 hash:	a193f2e61437e71a5f73aaa320bb086f3c32924b50cfc271d8c0d340de5c28105276681e523cf3292f5f3fa8f8160e83
First seen:	2026-10-10 06:51:27 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	49152:Y6MVX/SwHmfHGL4gd1O0cBd+L6GMcBdpkijwcMQ/LlL6GjGL4gd1OFcBdvk1GL4Y:Ie/P4/bDu1rHBZDE3Xcny
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_Double_Base64_Encoded_Executable_RID34CC Create hunting rule
Author:	Florian Roth
Description:	Detects an executable that has been encoded with base64 twice
Reference:	https://twitter.com/TweeterCyber/status/1189073238803877889
TLP:	TLP:WHITE

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-10-10 06:51:27 UTC Static: 4 Unpacker: 0 ClamAV: 0