YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash d80d8bbbc20d78ae388c981339b4ba1c1d9032e8a4b0844f60ffd8a96fabf241.

Scan Results

SHA256 hash:	d80d8bbbc20d78ae388c981339b4ba1c1d9032e8a4b0844f60ffd8a96fabf241
File size:	1'194'627 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	35656cce50fc5aa8a9144661211caa3b
SHA1 hash:	81cc25a1ac3db196e5478c24a4bcb07e64817236
SHA3-384 hash:	743a38a36142f2417b80541cf0828a9c4aee468927098397d62f7ebc3270790f1e56ba25dd7d386e202578cd34338337
First seen:	2026-03-14 15:34:43 UTC
Last seen:	Never
Sightings:	1
imphash :	5a498eee87e4d89512a84502f500181f Create hunting rule
ssdeep :	1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRqvYGVprxRuw/7:352T3siXei5bcmP9JfUjWhprx4wT
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	64f09c9a969cc0d4 Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	533f32c0-1fbb-11f1-b47f-42010aa4000b
File name:	35656cce50fc5aa8a9144661211caa3b
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	PUA.Win.Packer.Aspack-29 Create hunting rule

Signature:	PUA.Win.Packer.Aspack-30 Create hunting rule

Signature:	PUA.Win.Packer.ExeStealth-16 Create hunting rule

Signature:	Win.Dropper.Agent-336907 Create hunting rule

Signature:	Win.Ransomware.Loring-9798825-0 Create hunting rule

Signature:	Win.Trojan.Agent-179687 Create hunting rule

Signature:	Win.Trojan.Ircbot-4255 Create hunting rule

Signature:	Win.Trojan.Loring-1 Create hunting rule

Signature:	Win.Trojan.Loring-3 Create hunting rule

Signature:	Win.Trojan.Loring-4 Create hunting rule

Signature:	Win.Trojan.Loring-5 Create hunting rule

Signature:	Win.Trojan.Loring-6 Create hunting rule

Signature:	Win.Trojan.Obfuscated-1662 Create hunting rule

Signature:	Win.Worm.Specx-6854420-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	ASPackv212AlexeySolodovnikov Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	ASProtectV2XDLLAlexeySolodovnikov Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	classified
Author:	classified
Description:	classified
Reference:	classified
TLP :	TLP:AMBER

Rule name:	INDICATOR_EXE_Packed_ASPack Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ASPack
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	pe_detect_tls_callbacks Create hunting rule
Author:
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques
TLP:	TLP:WHITE
Repository:

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.