YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 465e87ba4ccd5fe49ec9a6c76d1ede0a8aaface136b26080dff6228f9d744773.

SHA256 hash:	465e87ba4ccd5fe49ec9a6c76d1ede0a8aaface136b26080dff6228f9d744773
File size:	3'757'813 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	b5bfdcc6aead8068a7d730737af2a12f
SHA1 hash:	d6926fc1f10c70e325af4db0758987e8b3f7fe19
SHA3-384 hash:	4a1aa735a23d8173c37544b2d8072b8a217a489a0a49700ee7acf45e64c5b2579d86cac25dc0834009fc34661ac65ed9
First seen:	2025-04-03 02:31:27 UTC
Last seen:	Never
Sightings:	1
imphash :	0035ece24c351f8bac8da9e8a2988620 Create hunting rule
ssdeep :	98304:8xwW6pcATt960JzNX7CPbZQIQBgp73VTlVK:82mATt9lJzNX7C1QIQBg
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.PUA.TorExe-1.UNOFFICIAL Create hunting rule

The following YARA rules matched on the file (static analysis).

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Pafish Create hunting rule
Author:	kevoreilly
Description:	Paranoid Fish Sandbox Detection
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	pe_detect_tls_callbacks Create hunting rule
Author:
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-04-03 02:31:27 UTC Static: 6 Unpacker: 0 ClamAV: 1