YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash c998225e81a057839b4c707f7804a6a6501f1fefb5d5f56c1cda976d89eccb24.

Scan Results

SHA256 hash: c998225e81a057839b4c707f7804a6a6501f1fefb5d5f56c1cda976d89eccb24
File size:2'245'736 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 01b9c29fb5010e87ce273ed00944436a
SHA1 hash: d0e11228fd3b0903dd402f912a2bce2d37bff0e6
SHA3-384 hash: 436fd120aad7fe8ce6ee93ae521d71dd2e474558b79151b31cfad35c2af6fe0a28dbc23839c0531a10392a016ebd7e0e
First seen:2026-04-02 15:47:47 UTC
Last seen:Never
Sightings:1
imphash : 3c10d2aa2614755ccdb513472bf0a6a1
Create hunting rule
ssdeep : 24576:/jjjrm/ev6jt1+qwJjjjrm/ev6jt1+qwcpjk+hexgAjhh:O/ev6Jwqt/ev6JwqI+4gAjhh
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:4bfe547e-2eab-11f1-b47f-42010aa4000b
File name:01b9c29fb5010e87ce273ed00944436a
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:TLP:WHITE
Repository:YARAify
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Runtime_Broker_Variant_1
Create hunting rule
Author:Sn0wFr0$t
Description:Detecting malicious Runtime Broker
TLP:TLP:WHITE
Repository:YARAify
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.