YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash de4f55c175a5a83f2b7bebe1d6e5d49dbcdc59165ad06f703bacf51903510413.

Scan Results

SHA256 hash: de4f55c175a5a83f2b7bebe1d6e5d49dbcdc59165ad06f703bacf51903510413
File size:311'296 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 1f1d9b36540725c4debdc155384ee26c
SHA1 hash: 885755b7518dab77e919f265c04b0a97ed7944af
SHA3-384 hash: 8f3525d487586e59bce3e481bc8150ca51860ae4968c679cb98fc626c8d0634d2baa88273ae5d3237271dd1854b69c2a
First seen:2026-04-27 14:49:34 UTC
Last seen:Never
Sightings:1
imphash : f51cb06b6e210226739d9b0d954b4a40
Create hunting rule
ssdeep : 6144:COy64/3hbfc2iEgKQl94t2YinK2MbtVr:COwfc2uK12YEKt
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 06d978e4dad2ec68
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:4e3c8ab6-4248-11f1-badc-42010aa4000b
File name:1f1d9b36540725c4debdc155384ee26c
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.