YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash da7a7e2671642ab54e2cbf46c62b2961ba235f47dbc70d26512c09f3b7aa8680.

Scan Results

SHA256 hash: da7a7e2671642ab54e2cbf46c62b2961ba235f47dbc70d26512c09f3b7aa8680
File size:110'592 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: d2cb3ae867a8f8241b257bb63f7b806b
SHA1 hash: 7c4ae27801b4f4e1902eff3b446092cf5b24d31b
SHA3-384 hash: bb66fda784d044e166ae04e2293bdf0fc86abbe66fdd76e6ed186ccc4fa6e502cf37ea475215a882171275aacd9c372d
First seen:2026-04-07 15:39:54 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 1536:vlHHysz/6uyy8/WY/yKQJa1HmAlfR9Rwk/Tr2GreyjS0Pz+Tcgr6SzI41jfwsLkF:F1z/Zy16FJ0mi2kWGreC41jBF0Zu
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:06098057-3298-11f1-b47f-42010aa4000b
File name:1e0000.shc
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:YARA.MALPEDIA_Win_Stealc_Auto.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:TLP:WHITE
Repository:YARAify
Rule name:Trojan_W32_Gh0stMiancha_1_0_0
Create hunting rule
TLP:TLP:WHITE
Repository:
Rule name:classified
Author:classified
TLP :TLP:AMBER
Rule name:win_stealc_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.stealc.
TLP:TLP:WHITE
Repository:Malpedia
Rule name:win_stealc_bytecodes_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research
Description:Bytecodes present in Stealc decoding routine
TLP:TLP:WHITE
Repository:embee-research
Rule name:Windows_Trojan_Generic_2993e5a5
Create hunting rule
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic
Rule name:Windows_Trojan_Stealc_5d3f297c
Create hunting rule
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic
Rule name:Windows_Trojan_Stealc_b8ab9ab5
Create hunting rule
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic
Rule name:yarahub_win_stealc_bytecodes_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.