YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash c428d3777be761bacb62fbc60f292fdb25105307f8945fa3a3ae54c5bf0f7312.

Scan Results

SHA256 hash: c428d3777be761bacb62fbc60f292fdb25105307f8945fa3a3ae54c5bf0f7312
File size:28'295'168 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: e1b7e8f2dba0f42af4021b890bdf5c41
SHA1 hash: 79ea7bfdcb34b7ba431697fa1cc49d5d48cc4b7b
SHA3-384 hash: 692962c093ed42ba79d960225cfd0db7121caf7dd9d2bb571722159f04342bf4673e5b26e73883e8791434fd839a69d1
First seen:2026-03-14 15:31:39 UTC
Last seen:Never
Sightings:1
imphash : cdc00badc7162acde9bb032e793ac137
Create hunting rule
ssdeep : 786432:Ve/UBX0DYsDSajfi/u94mWbNpjwZzHHKCO1o:8UJzaLgnbjqLgo
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:e564554c-1fba-11f1-b47f-42010aa4000b
File name:e1b7e8f2dba0f42af4021b890bdf5c41
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Fuerboos-9787227-0
Create hunting rule
Signature:Win.Malware.Picsys-9973737-0
Create hunting rule
Signature:Win.Malware.Vmprotect-9880672-0
Create hunting rule
Signature:Win.Malware.Vmprotect-9933009-0
Create hunting rule
Signature:Win.Malware.Wacatac-9786910-0
Create hunting rule
Signature:Win.Malware.Wacatac-9787279-0
Create hunting rule
Signature:Win.Packed.Convagent-9854021-0
Create hunting rule
Signature:Win.Trojan.Clicker-5301
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:pe_packer_pecompact2
Create hunting rule
Author:@jstrosch
TLP:TLP:WHITE
Repository:YARAify
Rule name:pecompact2
Create hunting rule
Author:Kevin Falcoz
Description:PECompact
TLP:TLP:WHITE
Rule name:PECompact2xxBitSumTechnologies
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:PECompactV2XBitsumTechnologies
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:PECompactv2xx
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:TLP:WHITE
Repository:YARAify
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
TLP:TLP:WHITE
Repository:Neo23x0

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.