YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash c6b6a50a897a82dd571b60caa714757d1b8f37af584999f6e65dc7ae8f630f26.

Scan Results


SHA256 hash: c6b6a50a897a82dd571b60caa714757d1b8f37af584999f6e65dc7ae8f630f26
File size:2'701'376 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 47a28389f12fec26d4c9185bc8187dbf
SHA1 hash: 19a4f85d0122e0d7845fd034a413d18d68ce3f45
SHA3-384 hash: 00a322219429b47fab83df4e4b1b7bd0fe7324181a6fbabe97466374a7ecac9d70355ca750924f3aa9a6d55679dbf590
First seen:2022-11-24 19:53:55 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 6144:889XR7BKBQPBFxclbXU1EKkcjuOSuw0QcODHauBIdhfx6QDI57BUdtB9H8bIDOBh:8CpBKBQNsoijOcFZezJJ6gJq9r7
TLSH : T173C53E55CCC7465EC974C2B1CCBA86F8633B2BCC52090B076799A621BD832EC5BD16F6
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:bab6b451-6c31-11ed-a71a-42010aa4000b
File name:1484b7c0.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.CoinMiner-20.UNOFFICIAL
Signature:Win.Trojan.B-468

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:MALWARE_Win_NjRAT
Author:ditekSHen
Description:Detects NjRAT / Bladabindi
TLP:TLP:WHITE
Repository:ditekshen
Rule name:RAT_njRat
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects njRAT
Reference:http://malwareconfig.com/stats/njRat
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:classified
Author:classified
TLP :TLP:GREEN
Rule name:win_njrat_w1
Author:Brian Wallace @botnet_hunter <bwall@ballastsecurity.net>
Description:Identify njRat
TLP:TLP:WHITE
Repository:malpedia
Rule name:Windows_Trojan_Njrat_30f3c220
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.