YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash f204dcf507d4d8b942b39ac372c4c4f60d3a9fb4d4b1e023cf08e8cd9c960e54.

Scan Results

SHA256 hash: f204dcf507d4d8b942b39ac372c4c4f60d3a9fb4d4b1e023cf08e8cd9c960e54
File size:6'303'744 bytes
File download: Original
MIME type:application/octet-stream
MD5 hash: d53d3b904445396ca7f6cdf2c73b4a92
SHA1 hash: 6f53eb6a09d9be8fecaabaa0edb8aeb71070969f
SHA3-384 hash: b6c5c7aa0a2dc40ad3d08d100e3ebb0af805aff9f944b613fcf8f591e2ff7d9d57ab0dddd977f0aab22ec06aec72e89b
First seen:2023-01-25 09:33:19 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 49152:jeELcf/YbLFGTGn4vd1x6n3vjHdACHIfHJ9QEOfi39KYOfth9KLtKVP:q+P
TLSH : T17A560119DAEE014EF3B3DF715BF5B5AE04E6F8E39D19926D611123093622A40CC63B36
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:4dc534a7-9c93-11ed-98c2-42010aa4000b
File name:4480000.shc
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:QbotStuff
Create hunting rule
Author:anonymous
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.