YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash e14aeecf81688651255b83de1f5803446ab32c98f9987e69e2f30b552d2e2c45.

Scan Results

SHA256 hash:	e14aeecf81688651255b83de1f5803446ab32c98f9987e69e2f30b552d2e2c45
File size:	350'813 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	2f231624a528a8361f844f41019ddbb3
SHA1 hash:	141396feccb2037438b9cdc08926584c19ab4aaa
SHA3-384 hash:	1c4e3a586f54ca85f8bb576950b055024f699e272b8a3ac5e6770a168cef9bbe2572882f550c33836cfb49f418e72354
First seen:	2026-01-15 15:29:31 UTC
Last seen:	Never
Sightings:	1
imphash :	f2e0b7b9a08bd8dcaf133d9278ecdb47 Create hunting rule
ssdeep :	6144:PjdFKdoSxvixTxUAHh/w2GWziZms1f4wYd2nOEZ6IR:jhGvixUAOv113YdS/ZZR
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	fd4ce1ad-f226-11f0-9df4-42010aa4000b
File name:	2f231624a528a8361f844f41019ddbb3
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.BackDoor.Meterpreter.19.UNOFFICIAL Create hunting rule

Signature:	Win.Exploit.D3b71c-9863766-0 Create hunting rule

Signature:	Win.Tool.CobaltStrike-6336852-0 Create hunting rule

Signature:	Win.Trojan.CobaltStrike-8091534-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	Beacon_K5om Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Meterpreter Beacon - file K5om.dll
Reference:	https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Beacon_K5om_RID2B14 Create hunting rule
Author:	Florian Roth
Description:	Detects Meterpreter Beacon - file K5om.dll
Reference:	https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
TLP:	TLP:WHITE

Rule name:	CobaltStrike Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect CobaltStrike Beacon in memory
Reference:	https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	CobaltStrike__Resources_Dnsstager_Bin_v1_47_through_v4_x Create hunting rule
Author:	gssincla@google.com
TLP:	TLP:WHITE
Repository:	GCTI

Rule name:	CobaltStrike_C2_Encoded_XOR_Config_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike C2 encoded profile configuration
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CobaltStrike_ReflectiveLoader_RID3297 Create hunting rule
Author:	Florian Roth
Description:	Detects reflective loader (Cobalt Strike)
Reference:	http://www.clearskysec.com/tulip
TLP:	TLP:WHITE

Rule name:	CobaltStrike_Resources_Beacon_Dll_v3_8 Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/beacon.dll Versions 3.8
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CobaltStrike_Resources_Dnsstager_Bin_v1_47_through_v4_x Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/dnsstager.bin signature for versions 1.47 to 4.x
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CobaltStrike_Unmodifed_Beacon Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects unmodified CobaltStrike beacon DLL
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Cobaltstrike1 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection
TLP:	TLP:WHITE
Repository:	AhmetPayaslioglu

Rule name:	Cobaltstrike2 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection
TLP:	TLP:WHITE
Repository:	AhmetPayaslioglu

Rule name:	Cobaltstrike3 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection
TLP:	TLP:WHITE
Repository:	AhmetPayaslioglu

Rule name:	CobaltStrikeBeacon Create hunting rule
Author:	ditekshen, enzo & Elastic
Description:	Cobalt Strike Beacon Payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	crime_win32_csbeacon_1 Create hunting rule
Author:	@VK_Intel
Description:	Detects Cobalt Strike loader
Reference:	https://twitter.com/VK_Intel/status/1239632822358474753
TLP:	TLP:WHITE
Repository:	k-vitali

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	HKTL_CobaltStrike_Beacon_Strings Create hunting rule
Author:	Elastic
Description:	Identifies strings used in Cobalt Strike Beacon DLL
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_Meterpreter_inMemory Create hunting rule
Author:	netbiosX, Florian Roth
Description:	Detects Meterpreter in-memory
Reference:	https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_Win_CobaltStrike Create hunting rule
Author:	threatintel@volexity.com
Description:	The CobaltStrike malware family.
Reference:	https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
TLP:	TLP:WHITE

Rule name:	INDICATOR_SUSPICIOUS_ReflectiveLoader Create hunting rule
Author:	ditekSHen
Description:	Detects Reflective DLL injection artifacts
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	Leviathan_CobaltStrike_Sample_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Cobalt Strike sample from Leviathan report
Reference:	https://goo.gl/MZ7dRg
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Leviathan_CobaltStrike_Sample_1_RID3324 Create hunting rule
Author:	Florian Roth
Description:	Detects Cobalt Strike sample from Leviathan report
Reference:	https://goo.gl/MZ7dRg
TLP:	TLP:WHITE

Rule name:	MALW_cobaltrike Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Rule to detect CobaltStrike beacon
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike
TLP:	TLP:WHITE
Repository:	advanced-threat-research

Rule name:	malware_CobaltStrike_v3v4 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect CobaltStrike Beacon in memory
Reference:	https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	Malware_QA_vqgk Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	VT Research QA uploaded malware - file vqgk.dll
Reference:	VT Research QA
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MALWARE_Win_CobaltStrike Create hunting rule
Author:	ditekSHen
Description:	CobaltStrike payload
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Description:	classified

Rule name:	PowerShell_Susp_Parameter_Combo_RID336F Create hunting rule
Author:	Florian Roth
Description:	Detects PowerShell invocation with suspicious parameters
Reference:	https://goo.gl/uAic1X
TLP:	TLP:WHITE

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research
TLP:	TLP:WHITE

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	troj_win_cobaltstrike_memoryinject Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Detects Cobalt Strike payload typically loaded into memory via PowerShell.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	WiltedTulip_ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:	http://www.clearskysec.com/tulip
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	classified
Author:	classified
TLP :	TLP:AMBER

Rule name:	win_cobalt_strike_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.cobalt_strike.
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	Windows_Trojan_CobaltStrike_3dc22d14 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_ee756db7 Create hunting rule
Description:	Attempts to detect Cobalt Strike based on strings found in BEACON
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_ee756db7 Create hunting rule
Author:	Elastic Security
Description:	Attempts to detect Cobalt Strike based on strings found in BEACON
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function leverage by metasploit shellcode
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
TLP:	TLP:WHITE
Repository:	elastic

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.