YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash c17ddde0441257b0bb89209499e88b1fc5b0744991f235fcc2d144ab30db5890.

Scan Results

SHA256 hash: c17ddde0441257b0bb89209499e88b1fc5b0744991f235fcc2d144ab30db5890
File size:3'597'552 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 61fb70062d6a3110b374dfd3a506c814
SHA1 hash: c6cbaf7ab6ce1e294ddfa307d50cac4417e0ff4a
SHA3-384 hash: bd0aecb1336e80873e11d7c339c1f138079e683171b4d6f083f089c900b2a67632511c4a3c735f8a63c5270aa9645e1d
First seen:2023-01-25 09:39:20 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 49152:2seBsRLcq/S9L6GjGL4gd1OcR7LdN+epkUG8GG8gL6GjGL4gd1OcR7LdN+epkUGI:2sesS
TLSH : T1BEF55822E9EB504DF3B29BB65FC8B9FF486EF673150E30B530620706A7229458D92735
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:252289ae-9c94-11ed-98c2-42010aa4000b
File name:14d7cb10.dll
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.PackedNET.972-1.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
TLP:TLP:WHITE
Repository:diˈtekSHən

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.