YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 250fa6f559799982900a10a852bf3f612f04fd5822481fd8c40f2460e778b5cc.

Scan Results

SHA256 hash: 250fa6f559799982900a10a852bf3f612f04fd5822481fd8c40f2460e778b5cc
File size:18'722'304 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 7d3e8d199ab53ba4c964a0284d3724db
SHA1 hash: 810349b1a8df219dc9e79895b08e41219ecb273f
SHA3-384 hash: 8f101a757a3115667f732b88f7f8fc8fdc4a674a58259179c8ce0e3561f7fa6daa2e5d6eaf6af390a35b403c8c048782
First seen:2024-10-18 05:13:09 UTC
Last seen:Never
Sightings:1
imphash : 07361a3a7f515bf56ca93120b2aca73b
Create hunting rule
ssdeep : 196608:ALg43G1W97Kv6bBEElukuFu4AHE62U2u:AL73Go97y6b10Fu4A
TLSH :n/a
telfhash :n/a
gimphash :n/a
File icon (PE):PE icon
dhash icon : 007079b9b9593800
Create hunting rule

Tasks

You can browse the 10 most recent tasks associated with this file blow.

Task Information

Task ID:aac08789-8d0f-11ef-b6ec-42010aa4000b
File name:7d3e8d199ab53ba4c964a0284d3724db
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.LyWgkx-2
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:GoBinTest
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:golang
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:golang_duffcopy_amd64
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:HUN_APT29_EnvyScout_Jul_2023_1
Create hunting rule
Author:Arkbird_SOLG
Description:Hunting rule for detect possible Envyscout malware used by the APT29 group by patterns already used in the past
TLP:TLP:WHITE
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:INDICATOR_TOOL_FastReverseProxy
Create hunting rule
Author:ditekSHen
Description:Detects Fast Reverse Proxy (FRP) tool
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
TLP:TLP:WHITE
Repository:
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
TLP:TLP:WHITE
Repository:
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
TLP:TLP:WHITE
Repository:
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
TLP:TLP:WHITE
Repository:
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:tool_frp_str
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:Detect fast reverse proxy (frp)
Reference:https://github.com/fatedier/frp
TLP:TLP:WHITE
Repository:JPCERTCC
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
TLP:TLP:WHITE
Repository:
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/
TLP:TLP:WHITE
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.