YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 1f78750585de1f96dca9a21643f677fedc13e22a83ad6f8fee77614bd974c5f8.

Scan Results

SHA256 hash:	1f78750585de1f96dca9a21643f677fedc13e22a83ad6f8fee77614bd974c5f8
File size:	3'858'994 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	d4319d554b5332d252130af5e1f7b848
SHA1 hash:	3091536f144396dd85f6779ee4ade814d2eb3cd4
SHA3-384 hash:	570cadb913e05beec78477a4bd812abe3ba80d9cf8a3508af6a123329f90255e54653276c88d49753147eac8ee12bcc7
First seen:	2024-02-05 10:30:20 UTC
Last seen:	Never
Sightings:	1
imphash :	9c895150e518f13037c383fcb3ae3401 Create hunting rule
ssdeep :	98304:PgmCS3pjH2d3z+JaO5PvATCYnnJb2dTM2UuCvpOC4qApXw:YmZ9HKrOR0CgnJyJMDuQp+
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	90365c4f-c411-11ee-89b0-42010aa4000b
File name:	400000.cssr.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	ditekSHen.MALWARE.Win.Trojan.CyberGate.UNOFFICIAL Create hunting rule

Signature:	MiscreantPunch.SingleXOR.EXE.188.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Win32.GenMalicious-CM.1024.UNOFFICIAL Create hunting rule

Signature:	Win.Packed.Spynet-6841468-0 Create hunting rule

Signature:	Win.Trojan.Agent-36200 Create hunting rule

Signature:	Win.Trojan.Bifrose-7001005-0 Create hunting rule

Signature:	Win.Trojan.Cybergate-5744895-0 Create hunting rule

Signature:	Win.Trojan.Llac-7 Create hunting rule

Signature:	Win.Worm.Explorerhijack-6999913-0 Create hunting rule

Signature:	Win.Worm.Rebhip-9834633-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Check_Dlls Create hunting rule
TLP:	TLP:WHITE
Repository:

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxProductID Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox product IDs
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)
TLP:	TLP:WHITE
Repository:

Rule name:	MALWARE_Win_CyberGate Create hunting rule
Author:	ditekSHen
Description:	Detects CyberGate/Spyrat/Rebhip RTA
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	RAT_CyberGate Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
Description:	Detects CyberGate RAT
Reference:	http://malwareconfig.com/stats/CyberGate
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	UPX20030XMarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques
TLP:	TLP:WHITE
Repository:

Rule name:	win_cybergate_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_cybergate_w0 Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	Windows_Generic_Threat_073909cf Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CyberGate_517aac7d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CyberGate_9996d800 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CyberGate_c219a2f3 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.