YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash beedd0b27508192545fb81c9fbdb2f8e9944f6fae3fa7bb87b8dc8de84231c98.

Scan Results

SHA256 hash:	beedd0b27508192545fb81c9fbdb2f8e9944f6fae3fa7bb87b8dc8de84231c98
File size:	4'182'426 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	dbef7f7a65fcb320d4af295e79c67ee8
SHA1 hash:	9d12dcee807c07575c1b648418658c35cf14e730
SHA3-384 hash:	b784e747cdc1487cc229a45545197495b267bbe156fe89f2a9f9fbd962b1463cd5070ba99e2041662085483c4e054322
First seen:	2026-10-09 23:21:44 UTC
Last seen:	Never
Sightings:	1
imphash :	6b0805bdf4927eb9bc27c92cdb53770a Create hunting rule
ssdeep :	98304:K+Tqdmm+RW5otAu92R/b68ZZlaKHQ0CLUxZAssZK3wjUWCSWVrwvJpG:Vm+qY/ezJqKH5dD/MKAHCSW
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	315d44cf-c438-11f1-b2b6-42010aa4000b
File name:	400000.dacd14e4-46a1-4c10-a72b-6b7606f2c35f.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Trojan.Packed2.49423-1.UNOFFICIAL Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	WIN_Malware_SalatStealer_ForgeAuto_542e717b Create hunting rule
Author:	Marjoriefort
Description:	Detects SalatStealer (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_43faefd2 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_7e8e91c4 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_92a28498 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_ce8c5b46 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_f1079127 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_ValleyRAT_ForgeAuto_401c5e16 Create hunting rule
Author:	Marjoriefort
Description:	Detects ValleyRAT (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.