YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash b94ac9cec49fe9bad9e854daaa917f4e21390dede4646a74b41b0d20f1cbd8c6.

Scan Results

SHA256 hash: b94ac9cec49fe9bad9e854daaa917f4e21390dede4646a74b41b0d20f1cbd8c6
File size:182'784 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 137657a95152cf382b7953c41006da5a
SHA1 hash: 728f7cd7eb4a6058b7da1a20e66dc86f0ff302a3
SHA3-384 hash: 31178b62884acfa114425c8c7a11cd05e38a50a6175dedd13875b99259b91fed2936053bc0c368a9c2aa13e28d47150d
First seen:2026-03-29 17:19:45 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 1536:qGfLE8nb0GvQ83Nq9Kr9ZyFnqnbnV9+4z+rM94fcQ7+4q56U9L0Bw2zL0I7nJJHL:9w8YGvQ89wESZ+bq7XZ8fyzkaLdout
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:7b72673a-2b93-11f1-b47f-42010aa4000b
File name:137657a95152cf382b7953c41006da5a
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:MAL_packer_lb_was_detected
Create hunting rule
Author:0x0d4y
Description:Detect the packer used by Lockbit4.0
TLP:TLP:WHITE
Repository:YARAify
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.