YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash d6a9fd6337c39e9bc8e5ecc166ac0878c709bf95b54fe9b50b4fc221b3a1d42a.

Scan Results

SHA256 hash: d6a9fd6337c39e9bc8e5ecc166ac0878c709bf95b54fe9b50b4fc221b3a1d42a
File size:93'860 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 195c145858d9a777c328e272c2f27a92
SHA1 hash: eb93bcdf54e8941b508890c66e219b563fd1faa5
SHA3-384 hash: 0743e47d0dd277e9d218ed48eb7bdd0fd783f02fcb1847830db4a62572b245d8115d54b36c64b74bae03749b57ed9c98
First seen:2022-11-24 19:52:21 UTC
Last seen:Never
Sightings:1
imphash : 501554e57a07082223b5a7f0d7aeccf1
Create hunting rule
ssdeep : 1536:gshfSWHHNvoLqNwDDGw3iYeHmh0HjWO1an:5hfxHNIXbeHm+HiO
TLSH : T197934B8F74D484FEF82456B0146B17718577AA50123A9BCB3BA8DD7D993B1268B3C383
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:828f4919-6c31-11ed-a71a-42010aa4000b
File name:400000.rundll32.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Ulise-9951569-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.