YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash e79d3006a94af706c0b8e7221571e3d9c8c67624243d2566e1e35f29aebc9cb8.

Scan Results

SHA256 hash: e79d3006a94af706c0b8e7221571e3d9c8c67624243d2566e1e35f29aebc9cb8
File size:832'455 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 8b93ce5c58c492718366a79b39e856d5
SHA1 hash: cbb1224f04148adb482b942248a9ff38fbcd387e
SHA3-384 hash: 424927c0ad3b5bfcb5ecfef1adf122c12586768b08c33d46bf260777142f15a745109ce26d0f49ce83bb065512aebde1
First seen:2022-11-24 19:43:21 UTC
Last seen:Never
Sightings:1
imphash : 7c8739dcd0277d6994e1e4ca3373511b
Create hunting rule
ssdeep : 12288:AKKjmblWck3gBePV+qjIlXXPU+a/mmZdnuDWm:AKEmxBkUqOXMumdN
TLSH : T1EF057C21A950F03AE8A754F19DAEC24A55287F34172921C7B2C06FAE25F16E37F36713
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:40a4077f-6c30-11ed-a71a-42010aa4000b
File name:400000.lHe09400bLgDp09400.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Fragtor-9954285-0
Create hunting rule
Signature:Win.Trojan.Fakeav-82100
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.