YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash e464db75b9340b6930d649aa67fc96b34b890240b039375c00743705fa3f750d.

Scan Results


SHA256 hash: e464db75b9340b6930d649aa67fc96b34b890240b039375c00743705fa3f750d
File size:390'001 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: fd7b9a96e9f27ff022a5cbc7ae899689
SHA1 hash: be073153a745b9e8d4ae18f07a033edf83ad90fb
SHA3-384 hash: 5e48e6feef8c6a0160ebb7da39d280a1105bb00dd6578a4e3a3bdbd107e8e94ba8d2bb30ada5702f54131bd7275b4777
First seen:2023-01-25 09:41:47 UTC
Last seen:Never
Sightings:1
imphash : 286eac8d8bd4ba11370ca9c14bebe686
ssdeep : 6144:XWE3IrvTn5BIQs4D7ems0gQPPai3jNrIy9Co5:XWE3IrT5+Qs4D7emLgkCwNsICo5
TLSH : T1E284C713E730ACA6F428627662BF0739BD74D3513CB08527FBA0CEB15CA56624B57A0D
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:7c8e549e-9c94-11ed-98c2-42010aa4000b
File name:400000.svohost.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Dropper.Tiggre-9845940-0
Signature:Win.Dropper.Tinba-9943147-2

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:INDICATOR_EXE_Packed_MPress
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:ditekshen
Rule name:MALWARE_Win_BlackMoon
Author:ditekSHen
Description:Detects executables using BlackMoon RunTime
TLP:TLP:WHITE
Repository:ditekshen
Rule name:meth_get_eip
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:yaraify
Rule name:TeslaCryptPackedMalware
TLP:TLP:WHITE
Repository:malware-bazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.